Profile Applicability:
Level 1
Description:
The number of administrator accounts with privileged access to the build environment must be limited to the minimum necessary to perform essential management and operational tasks. Restricting administrative privileges reduces the risk of unauthorized changes, insider threats, and accidental misconfigurations.
Rationale:
Minimizing administrator accounts enforces the principle of least privilege, improves accountability, and reduces the attack surface. It supports compliance with security policies and strengthens the overall security posture of the build environment.
Impact:
Pros:
Reduces risk of unauthorized or malicious actions.
Simplifies management and auditing of privileged access.
Enhances accountability and control over critical systems.
Cons:
May create operational bottlenecks if administrative duties are too narrowly assigned.
Requires careful access management and succession planning.
Default value:
Build environments may have more administrators than necessary by default, increasing risk exposure.
Audit:
Review the list of administrators and their access levels within the build environment. Verify periodic access reviews and removal of unnecessary privileges.
Remediation:
Define and enforce policies limiting administrative access. Remove or downgrade excess administrator accounts. Conduct regular access reviews and audits. Educate teams on least privilege principles.
References:
CIS Controls v8, Control 5 - Account Management: https://www.cisecurity.org/controls/account-management/
NIST SP 800-53 AC-2 Account Management: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
OWASP Privilege Management: https://owasp.org/www-project-application-security-verification-standard/latest/4-Authentication-Session-Management.html#privilege-management