Ensure administrators and directory groups are granted least- privilege roles via management access policies

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

From the CLI: ; Run the command pureadmin list to display all local administrators. ; Review the Access Policy column in the output to confirm that each account has the appropriate minimum-privilege policy attached (and no account is unnecessarily set to array_admin). ; Run the command pureds role list to display the current LDAP/AD group to Purity//FA access policy mappings and verify their assignments. ; Run purepolicy management-access list to inspect the permissions, scopes, and aggregation strategies of all configured access policies.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

To align with the security recommendations, assign users and groups the minimum role needed to accomplish their responsibilities by leveraging Purity//FA's built-in or custom Management Access Policies. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; For Local Users: In the Users panel, click the edit (three vertical dots) icon for the user account and select Change Access Policy. Remove any overly permissive policies and assign the appropriate minimum-privilege policy. ; For Directory Service Groups: In the Directory Service panel, click the edit icon in the Roles section.