TMA-SSC-4.2.5
Ensure anonymous access to artifacts is revoked
설명
Disable anonymous access to artifacts. Most artifact repositories support anonymous users, such as JFrog and Nexus. For unauthorized users, this defaults to a user with only read permissions, though more permissions may be added. Disable the option to view artifacts as “Anonymous User” in order to protect private artifacts from being exposed. This way, only trusted and authorized members will be able to access artifacts. Note Only logged and authorized users will be able to access artifacts.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
For each artifact or package manager in use, verify that anonymous access is disabled.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Disable the anonymous access option on every artifact or package manager in use. 4.3 Package Registries This section consists of security recommendations for management of package registries and artifacts that are stored in them. Package registries are where the organization artifacts are stored. To keep an artifact safe, you must keep the registry where it is stored safe too. Furthermore, you need to ensure that every artifact that reaches the registry is safe to use and does not put the registry in danger. 51 CIS Software Supply Chain Security Guide
속성
- 운영 체제
- 모두
- 태그
- access-controldevsecopssupply-chain
- 참고 자료
- CIS Software Supply Chain Security Guide Benchmark v1.0.0 - 4.2.5 Ensure anonymous access to artifacts is revoked