UCF STIG Viewer Logo

The Akamai Luna Portal must automatically audit account enabling actions.


Overview

Finding ID Version Rule ID IA Controls Severity
V-76475 AKSD-DM-000016 SV-91171r1_rule Medium
Description
Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to enable a new or disabled account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail that documents the creation of application user accounts and notifies administrators and ISSOs. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.
STIG Date
Akamai KSD Service Impact Level 2 NDM Security Technical Implementation Guide 2017-09-15

Details

Check Text ( C-76135r1_chk )
Verify that the portal is sending Luna Event notifications:

1. Log in to the Luna Portal as an administrator.
2. Select Configure >> Alerts.
3. Search/filter for "Luna Control Center Event".
4. Click on "account enabling".
5. Verify that the following settings are selected by clicking the "Settings" button:
"Manage - Manage Users".

If the Luna Control Center event notifications are not enabled, this is a finding.
Fix Text (F-83153r1_fix)
Enable Luna Event notifications.

1. Log in to the Luna Portal as an administrator.
2. Select Configure >> Alerts.
3. Click the "Create New Alert" button.
4. Select "Luna Control Center Event" and press the "Next" button.
5. Check the box that reads "Manage - Manage Users".
6. Proceed through the alert creation wizard, filling out the appropriate fields, and then click "Submit".