Ensure administrators and directory groups are granted least- privilege roles via management access policies

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

From the CLI: ; Run the command pureadmin list to display all local administrators. ; Review the Access Policy column in the output to confirm that each account has the appropriate minimum-privilege policy attached (and no account is unnecessarily set to array_admin). ; Run the command pureds role list to display the current LDAP/AD group to Purity//FA access policy mappings and verify their assignments. ; Run purepolicy management-access list to inspect the permissions, scopes, and aggregation strategies of all configured access policies.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

To align with the security recommendations, assign users and groups the minimum role needed to accomplish their responsibilities by leveraging Purity//FA's built-in or custom Management Access Policies. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; For Local Users: In the Users panel, click the edit (three vertical dots) icon for the user account and select Change Access Policy. Remove any overly permissive policies and assign the appropriate minimum-privilege policy. ; For Directory Service Groups: In the Directory Service panel, click the edit icon in the Roles section.