OpenControls Logo

STIG Viewer

STIGViewer Support

The Dragos Platform must only allow local administrative and service user accounts.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-270919DRAG-OT-000240SV-270919r1107124_ruleCCI-000166medium
Description
Only two default accounts facilitate the initial setup and configuration of the Platform. These accounts provide immediate access to the system, allowing administrators to quickly get the system up and running without needing to create new user accounts during the initial installation phase. During maintenance, updates, or support operations, default accounts allow vendor support teams to access the system without needing to manage a variety of customer-specific accounts. This can streamline support activities and reduce downtime. Default accounts passwords need to be protected so they cannot be exploited by attackers to gain unauthorized access to the system. Satisfies: SRG-APP-000080, SRG-APP-000234
STIGDate
Dragos Platform 2.x Security Technical Implementation Guide2025-05-15

Related Frameworks

2 mappings across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-15.2Removal of Temporary / Emergency Accounts
1.00
MON-09Non-Repudiation
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (58) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00

+48 more (top 10 by confidence shown)

CCI2 mappings
CCI-000166
1.00
CCI-001682
1.00

Details

Check Text (C-270919r1107124_chk)

Verify local user accounts. While logged in to the Dragos Platform with a user account with administrative privileges, navigate to Admin >> User Management >> Users. If any local user except the UI Administrator and DragOS CLI Service Account exists, this is a finding.

Fix Text (F-74863r1107123_fix)

Remove users except the UI Administrator and DragOS CLI Service Account. While logged in to the Dragos Platform with a user account with administrative privileges, navigate to Admin >> User Management >> Users. Click the kebab menu next to the user and select "Delete User". Click "DELETE" in the verification window.