GitHub
TMA-GITHUB-1.4.1
Ensure administrator approval is required for every installed application
Descrição
Ensure an administrator approval is required when installing applications. Applications are typically automated integrations that improve the workflow of an organization. They are written by third-party developers, and therefore should be validated before using in case they're malicious or not ... Reported as a manual review item: no reliable read-only gh api check exists for this control.
Como é verificado
Método de auditoria: Revisão manual
Verify that applications are installed only after receiving administrator approval: a. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them. b. For OAuth Apps, perform the following: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Next to the organization, click Settings. 3. In the "Third-party Access" section of the sidebar, click OAuth application policy. 4.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Require an administrator approval for every installed application: a. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them. b. For OAuth Apps, perform the following: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Next to the organization, click Settings. 3. In the "Third-party Access" section of the sidebar, click OAuth application policy. 4. Under "Third-party application access policy", click Setup application access restrictions. 5. After you review the information about third-party access restrictions, click Restrict third-party application access.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- githubsource-code
- Referência
- CIS GitHub Benchmark v1.2.0 - 1.4.1 Ensure administrator approval is required for every installed application