All Prisma Cloud Compute users must have a unique, individual account.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-253535 | CNTR-PC-000510 | SV-253535r1051115_rule | CCI-000764 | medium |
| Description | ||||
| Prisma Cloud Compute does not have a default account. During installation, the installer creates an administrator. This account can be removed once other accounts have been added. To ensure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system. | ||||
| STIG | Date | |||
| Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide | 2024-12-06 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
IA-2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.5.1
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.5.2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000764
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-253535r1051115_chk)
Confirm there is only one "break glass" local administrative account.
Navigate to Prisma Cloud Compute Console's Manage >> Authentication >> Users tab.
Only the administrative break glass account is allowed to have Authentication Method = Local.
For all other accounts, Authentication Method = SAML.
If any local account, except the administrative break glass account, has Authentication Method set to other than "SAML", this is a finding.
Fix Text (F-56938r840442_fix)
Navigate to Prisma Cloud Compute Console's >> Manage >> Authentication >> Users tab.
Ensure only the break glass administrator account is a "local" account.
Delete all other local accounts and use the SAML identity provider for all authentication and authorization to the Prisma Cloud Compute Console.