CDP 35948452: Confirm Uniqueness of IDs and Passwords (app/AI) #9
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
CDP Control ID:
35948452Category: User Access Management
Frequency: Biannually
Owner: h.noerenberg
Parent: #1
Requirement & Guidance
User Access Management Requirement: Confirm uniqueness of user IDs and passwords for each individual. Individual User IDs must not be shared. Guidance: Confirm that the User Ids and Passwords in client applications are unique and personal to all the resources. Confirm that there are no common or shared IDs between resources. Passwords must be stored securely (in password vault or equivalent). For password vaults, internet access can be allowed for these if the following 3 controls are in place: Strong Auth (no access keys, secrets, RBAC integration with Entra): https://learn.microsoft.com/en-us/azure/key-vault/general/authentication KeyVault Logs must be enabled: https://learn.microsoft.com/en-us/azure/key-vault/general/logging?tabs=Vault Azure Defender for KeyVault must be used and alerts delivered to SIEM and actioned upon: https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-key-vault-planFollow the Identification and Authentication standard for further requirements on approved Password vaults and specific requirements. Additional information can be found on CDP website User Access Management
CapaKraken Action Plan — 35948452 Unique IDs & Passwords
Scope: Eindeutige User-IDs + Passwörter, keine geteilten Logins, Passwort-Vault, MFA für Vault-Nutzung.
Aktueller Stand:
docs/acn-security-compliance-status.md3.2.2.1.01 OK — Auth.js v5 + Argon2 + TOTP MFAUser.email)Todos:
.envausserhalb Secrets-ManagerUserRole=ADMIN-Konten haben MFA aktiviertdocs/secrets-management.md(neu) + Admin-MFA-ReportDateien:
packages/api/src/router/auth/*,packages/db/prisma/schema.prisma(User model)CapaKraken Compliance-Status
EAPPS-Mapping:
3.2.2.1.01Status: ✅ OK (laut
docs/acn-security-compliance-status.md)Zusammenfassung
Jeder User hat eine eindeutige E-Mail-ID, Passwörter sind Argon2id-gehasht mit zufälligem Salt. Keine shared/default Credentials.
Nachweis
User.email @unique(Prisma) —packages/db/prisma/schema.prismapackages/api/src/router/auth.ts,scripts/setup-admin.mjs$argon2id$Hash) —scripts/import-dev-seed.mjsEntscheidung: Control ist nachweislich erfüllt → Ticket wird geschlossen.