Title

The VMM must provide automated mechanisms for supporting account management functions. (Cat II impact)

Discussion

Enterprise environments make account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. A comprehensive account management process that includes automation helps to ensure accounts designated as requiring attention are consistently and promptly addressed. Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated or by disabling accounts located in non-centralized account stores such as multiple servers. This requirement applies to all account types, including individual/user, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. The automated mechanisms may reside within the VMM itself or may be offered by other infrastructure providing automated account management capabilities. Automated mechanisms may be composed of differing technologies that, when placed together, contain an overall automated mechanism supporting an organization's automated account management requirements. Account management functions include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the VMM to monitor account usage; and using automated telephonic notification to report atypical system account usage.

Check Content

Verify the VMM provides automated mechanisms for supporting account management functions. If it does not, this is a finding.

Fix Text

Configure the VMM to provide automated mechanisms for supporting account management functions.

Additional Identifiers

Rule ID: SV-207338r958362_rule

Vulnerability ID: V-207338

Group Title: SRG-OS-000001

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.