OpenControls Logo

STIG Viewer

STIGViewer Support

Dragos Platform must use an Identity Provider (IDP) for authentication and authorization processes.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-270910DRAG-OT-000090SV-270910r1057994_ruleCCI-000015medium
Description
Enterprise environments make application account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. A comprehensive application account management process that includes automation helps to ensure accounts designated as requiring attention are consistently and promptly addressed. Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated or by disabling accounts located in noncentralized account stores such as multiple servers. This requirement applies to all account types, including individual/user, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. Dragos Platform must be configured to automatically provide account management functions and these functions must immediately enforce the organization's current account policy. The automated mechanisms may reside within Dragos Platform itself or may be offered by the operating system or other infrastructure providing automated account management capabilities. Automated mechanisms may be comprised of differing technologies that when placed together contain an overall automated mechanism supporting an organization's automated account management requirements. Account management functions include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephonic notification to report atypical system account usage. Satisfies: SRG-APP-000023, SRG-APP-000025, SRG-APP-000065, SRG-APP-000149, SRG-APP-000150, SRG-APP-000151, SRG-APP-000152, SRG-APP-000163, SRG-APP-000165, SRG-APP-000170, SRG-APP-000173, SRG-APP-000233, SRG-APP-000345, SRG-APP-000317, SRG-APP-000318
STIGDate
Dragos Platform 2.x Security Technical Implementation Guide2025-05-15

Related Frameworks

15 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (22) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00
IAC-04Identification & Authentication for Devices
1.00
IAC-05Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)
1.00
IAC-15.3Disable Inactive Accounts
1.00
IAC-15.8Usage Conditions
1.00
IAC-22Account Lockout
1.00
END-16Restrict Access To Security Functions
0.50
IAC-06Multi-Factor Authentication (MFA)
0.50

+12 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (86) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-17(1)Monitoring and Control
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00

+76 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.8
1.00
3.5.10
1.00
3.5.3
1.00
3.5.5
1.00
3.5.6
1.00
3.5.7
1.00
3.5.8
1.00
3.5.9
1.00
CCI15 mappings
CCI-000015
1.00
CCI-000017
1.00
CCI-000044
1.00
CCI-000195
1.00
CCI-000198
1.00
CCI-000200
1.00
CCI-000765
1.00
CCI-000766
1.00
CCI-000767
1.00
CCI-000768
1.00

+5 more (top 10 by weight shown)

NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
1.00
PR.AA-03
1.00
PR.AAIdentity Management, Authentication, and Access Control
0.50
PR.AA-04
0.50
PR.AA-05
0.50

Who does this work

7 NICE work roles and 5 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-270910r1057994_chk)

Review the authentication method being used by the Platform. In the UI, navigate to Admin >> SiteStore Management >> Authentication Providers. If the Platform does not have an Authentication Provider configured, this is a finding.

Fix Text (F-74854r1057993_fix)

Configure LDAP. In the UI, navigate to Admin >> SiteStore Management >> Authentication Providers. Next to LDAP/Active Directory, click "ADD PROVIDER". Fill in the configuration in the "Add New LDAP Provider" form. Click "Save".