The Akamai Luna Portal must automatically audit account enabling actions.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-76475 | AKSD-DM-000016 | SV-91171r1_rule | CCI-002130 | medium |
| Description | ||||
| Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to enable a new or disabled account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail that documents the creation of application user accounts and notifies administrators and ISSOs. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. | ||||
| STIG | Date | |||
| Akamai KSD Service Impact Level 2 NDM Security Technical Implementation Guide | 2017-09-15 | |||
Details
Check Text (C-91171r1_chk)
Verify that the portal is sending Luna Event notifications:
1. Log in to the Luna Portal as an administrator.
2. Select Configure >> Alerts.
3. Search/filter for "Luna Control Center Event".
4. Click on "account enabling".
5. Verify that the following settings are selected by clicking the "Settings" button:
"Manage - Manage Users".
If the Luna Control Center event notifications are not enabled, this is a finding.
Fix Text (F-83153r1_fix)
Enable Luna Event notifications.
1. Log in to the Luna Portal as an administrator.
2. Select Configure >> Alerts.
3. Click the "Create New Alert" button.
4. Select "Luna Control Center Event" and press the "Next" button.
5. Check the box that reads "Manage - Manage Users".
6. Proceed through the alert creation wizard, filling out the appropriate fields, and then click "Submit".