TMA-GITLAB-1.4.3
Ensure the access granted to each installed application is limited to the least privilege needed
설명
Ensure installed application permissions are limited to the lowest privilege level required. Applications are typically automated integrations that can improve the workflow of an organization. They are written by third-party developers, and therefore should be reviewed carefully before use. It is recommended to use the "least privilege" principle, granting applications the lowest level of permissions required. This may prevent harm from a potentially malicious application with unnecessarily high-level permissions leaking data or modifying source code.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Verify that each installed integration and application has the least privilege needed. For each Project and each Group, perform the following: - Navigate to the project or group homepage - In the sidebar, select Settings > Integrations - Next to every integration, select 'Configure' - Review the integration's configuration and verify that it is limited to the least privilege needed For each Group, perform the following: - Navigate to the project or group homepage - In the sidebar, select Settings > Applications o Next to every Application, select Edit o Review the Applications configuration and verify that it is limited to the least privilege needed As an administrator, perform the following: - Navigate to the Admin Area - In the sidebar, select Applications o Next to every Application, select Edit o Review the Applications configuration and verify that it is limited to the least privilege needed - In the sidebar, select Settings > Integrations o Next to every integration, select 'Configure' o Review the integration's configuration and verify that it is limited to the least privilege needed - In the sidebar, select Overview > Users o Select each user's first name o On the users...
조치 방법
조치 방식: 가이드 또는 인프라 패치
Grant permissions to applications by the "least privilege" principle, meaning the lowest possible permission necessary. For any Integrations identified during the audit as needing modification: - Next to the integration, select Configure. - Edit the permissions or settings so that they grant the least possible privileges. For example, restrict the branches it can access, or the features that are enabled. - (Optionally) Select 'Test settings' - Select 'Save changes'. For any Applications identified during the audit as needing modification: - Next to the application, select 'Edit'. - Edit the permissions or settings so that they grant the least possible privileges. For example, restrict the API scopes it can use. - Select 'Save application'. If any user authorized applications were identified during the audit as having overly permissive scopes, as an administrator perform the following: - Navigate to the Admin Area - In the sidebar, select Overview > Users o Select the user's first name o On the users detail page, select 'Impersonate' o Navigate to their Preferences page o In the sidebar, select Applications o Under 'Authorized applications', re-identify the overly permissive appl...
속성
- 운영 체제
- 모두
- 태그
- access-controldevsecopsgitlab
- 참고 자료
- CIS GitLab Benchmark v1.0.1 - 1.4.3 Ensure the access granted to each installed application is limited to the least privilege needed