Profile Applicability:
 Level 1

Description:
 All code changes must undergo a mandatory approval process by at least two distinct users who are strongly authenticated before being merged or deployed.  Strong authentication typically involves multi-factor authentication (MFA) to verify the identity of approvers. This control ensures that no single individual can unilaterally introduce changes, thereby reducing the risk of unauthorized, malicious, or erroneous code modifications.

Rationale:
 Requiring dual approval with strong authentication mitigates risks of insider threats, accidental errors, and unauthorized code changes. It enforces segregation of duties and ensures accountability, improving code integrity and compliance with security policies and regulations.

Impact:
 Pros:

  • Enhances code integrity through peer review and approval.

  • Reduces risk of unauthorized or malicious code changes.

  • Enforces segregation of duties and accountability.

  • Supports compliance with industry standards and regulations.

Cons:

  • May increase development cycle time due to approval process.

  • Requires integration and management of strong authentication mechanisms.

Default value:
 By default, some code repositories or CI/CD pipelines may allow single-user approvals without mandatory MFA enforcement.

Audit:
 Verify that all code merges or deployments have documented approvals from at least two distinct users who authenticated with MFA. Review logs from version control and authentication systems to confirm compliance.

Remediation:
 Configure branch protection rules or pull request policies in version control platforms (e.g., GitHub, GitLab, Bitbucket) to require approvals from two users with enforced MFA. Educate developers and approvers on using strong authentication methods. Regularly review access and authentication policies.

References:

  1. GitHub Branch Protection Rules: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-protected-branches

  2. GitLab Merge Request Approvals: https://docs.gitlab.com/ee/user/project/merge_requests/approvals/

  3. CIS Controls v8, Control 6.2 - Use of Multi-Factor Authentication for Access to Privileged Accounts: https://www.cisecurity.org/controls/multi-factor-authentication/