Dragos Platform 2.x STIG Version Comparison

There are 4 differences between versions v1 r1 (Sept. 26, 2024) (the "left" version) and v1 r3 (July 2, 2025) (the "right" version).

Check DRAG-OT-000240 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

The Dragos Platform must only allow local administrative and service user accounts.

Check Content

Verify local user accounts. While logged in to the Dragos Platform with a user account with administrative privileges, navigate to Admin >> User Management >> Users. If any local user except the UI Administrator and DragOS CLI Service account Account exists, is found, this is a finding.

Discussion

Only two default accounts facilitate the initial setup and configuration of the Platform. These accounts provide immediate access to the system, allowing administrators to quickly get the system up and running without needing to create new user accounts during the initial installation phase. During maintenance, updates, or support operations, default accounts allow vendor support teams to access the system without needing to manage a variety of customer-specific accounts. This can streamline support activities and reduce downtime. Default accounts passwords need to be protected so they cannot be exploited by attackers to gain unauthorized access to the system. Satisfies: SRG-APP-000080, SRG-APP-000234

Fix

Remove nonessential users. While users except the UI Administrator and DragOS CLI Service Account. While logged in to the Dragos Platform with a user account with administrative privileges, navigate to Admin >> User Management >> Users. Click the kebab menu next to the user and select "Delete User". Click "DELETE" in the verification window.