Nutanix AOS role mapping must be configured to the lowest privilege level needed for user access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254100	NUTX-AP-000060	SV-254100r846388_rule		Medium

Description
Strong access controls are critical to securing the application server. Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) must be employed by the application server to control access between users (or processes acting on behalf of users) and objects (e.g., applications, files, records, processes, application domains) in the application server. Without stringent logical access and authorization controls, an adversary may have the ability, with very little effort, to compromise the application server and associated supporting infrastructure.

Description

Strong access controls are critical to securing the application server. Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) must be employed by the application server to control access between users (or processes acting on behalf of users) and objects (e.g., applications, files, records, processes, application domains) in the application server. Without stringent logical access and authorization controls, an adversary may have the ability, with very little effort, to compromise the application server and associated supporting infrastructure.

STIG	Date
Nutanix AOS 5.20.x Application Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-57585r846386_chk )
Nutanix AOS supports user and group role mapping. Ensure all users or groups match that of the documented mapping policies defined by the ISSO. 1. Log in to Prism Element. 2. Click on the gear icon in the upper right. 3. Navigate to "role mapping". For each user or group listed, ensure the role granted is according to access control policies. If not, this is a finding.

Fix Text (F-57536r846387_fix)
Configure the user and group mappings to be compliant with the documented mapping policies defined by the ISSO. 1. Log in to Prism Element. 2. Click on the gear icon in the upper right. 3. Navigate to "role mapping". 4. Add users and groups to role mappings per policy.