TMA-IBMCLOUD-1.1
Monitor account owner for frequent, unexpected, or unauthorized logins
Опис
Monitor login activity of the account owner to prevent unauthorized usage of the privileged account. The owner of an IBM Cloud account by default has administrative privileges across the account. There may be other users also assigned administrative privileges to the account. To prevent unauthorized or unintended usage, login credentials should never be shared and users in an organization should be granted least privilege to complete their required tasks. To manage the account, administrators are granted permissions to manage services and Cloud resources. Therefore, access by the account owner to the account to run tasks should be minimum. By monitoring the number of times that the account owner and administrative users log in to the account, you can: - Monitor administrative access to the IBM Cloud account - Identify abnormal behavior - Enforce that administrators and operators of th...
Како се проверава
Метод провере: Ручни преглед
Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.
Before you can monitor and manage IBM event data with IBM Cloud Logs, you must provision an instance of the IBM Cloud Logs service. Refer to the IBM Cloud Logs documentation to provision and start using an instance of IBM Cloud Logs https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-getting-started.
Како се исправља
Метод исправке: Смерница или закрпа инфраструктуре
Complete the following steps to monitor how many times an account owner logs in to the account: First, you need to identify the email of the account owner. 1. In the Cloud UI, go to Manage, Access (IAM), then select Users. 2. Identify the users identified with administrator privileges. 3. Select the account owner. Then, click Details. 4. Copy the email address of the account owner. Launch the Activity Tracker instance in Frankfurt. This is the instance where login security events are collected in the account. In the Views section, select the Everything view. Then, enter the following query in the search bar: (action login) AND initiator.name:<email address> Replace with the account owner's email address. The view now reports all the login actions that are reported for the account owner. Next, you can define an alert on the view to get a notification when N number of events are received within a 24 hour period. The value of N depends on how you operate your cloud. You can start with a default value of 25 and increase or decrease depending on the tasks that the account administrator can perform in the account.
Својства
- Оперативни системи
- Било који
- Ознаке
- authcloudibmcloudloggingmonitoring
- Референца
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.1 Monitor account owner for frequent, unexpected, or unauthorized logins