TMA-IBMCLOUD-1.1
Monitor account owner for frequent, unexpected, or unauthorized logins
説明
Monitor login activity of the account owner to prevent unauthorized usage of the privileged account. The owner of an IBM Cloud account by default has administrative privileges across the account. There may be other users also assigned administrative privileges to the account. To prevent unauthorized or unintended usage, login credentials should never be shared and users in an organization should be granted least privilege to complete their required tasks. To manage the account, administrators are granted permissions to manage services and Cloud resources. Therefore, access by the account owner to the account to run tasks should be minimum. By monitoring the number of times that the account owner and administrative users log in to the account, you can: - Monitor administrative access to the IBM Cloud account - Identify abnormal behavior - Enforce that administrators and operators of th...
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
Before you can monitor and manage IBM event data with IBM Cloud Logs, you must provision an instance of the IBM Cloud Logs service. Refer to the IBM Cloud Logs documentation to provision and start using an instance of IBM Cloud Logs https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-getting-started.
修正方法
修正方法: ガイダンスまたは IaC パッチ
Complete the following steps to monitor how many times an account owner logs in to the account: First, you need to identify the email of the account owner. 1. In the Cloud UI, go to Manage, Access (IAM), then select Users. 2. Identify the users identified with administrator privileges. 3. Select the account owner. Then, click Details. 4. Copy the email address of the account owner. Launch the Activity Tracker instance in Frankfurt. This is the instance where login security events are collected in the account. In the Views section, select the Everything view. Then, enter the following query in the search bar: (action login) AND initiator.name:<email address> Replace with the account owner's email address. The view now reports all the login actions that are reported for the account owner. Next, you can define an alert on the view to get a notification when N number of events are received within a 24 hour period. The value of N depends on how you operate your cloud. You can start with a default value of 25 and increase or decrease depending on the tasks that the account administrator can perform in the account.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- authcloudibmcloudloggingmonitoring
- 参照
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.1 Monitor account owner for frequent, unexpected, or unauthorized logins