Ensure administrators and directory groups are granted least- privilege roles via management access policies

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

From the CLI: ; Run the command pureadmin list to display all local administrators. ; Review the Access Policy column in the output to confirm that each account has the appropriate minimum-privilege policy attached (and no account is unnecessarily set to array_admin). ; Run the command pureds role list to display the current LDAP/AD group to Purity//FA access policy mappings and verify their assignments. ; Run purepolicy management-access list to inspect the permissions, scopes, and aggregation strategies of all configured access policies.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To align with the security recommendations, assign users and groups the minimum role needed to accomplish their responsibilities by leveraging Purity//FA's built-in or custom Management Access Policies. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; For Local Users: In the Users panel, click the edit (three vertical dots) icon for the user account and select Change Access Policy. Remove any overly permissive policies and assign the appropriate minimum-privilege policy. ; For Directory Service Groups: In the Directory Service panel, click the edit icon in the Roles section.