CDP Control ID:35948452 Category: User Access Management Frequency: Biannually Owner: h.noerenberg Parent:#1
Requirement & Guidance
User Access Management Requirement: Confirm uniqueness of user IDs and passwords for each individual. Individual User IDs must not be shared. Guidance: Confirm that the User Ids and Passwords in client applications are unique and personal to all the resources. Confirm that there are no common or shared IDs between resources. Passwords must be stored securely (in password vault or equivalent). For password vaults, internet access can be allowed for these if the following 3 controls are in place: Strong Auth (no access keys, secrets, RBAC integration with Entra): https://learn.microsoft.com/en-us/azure/key-vault/general/authentication KeyVault Logs must be enabled: https://learn.microsoft.com/en-us/azure/key-vault/general/logging?tabs=Vault Azure Defender for KeyVault must be used and alerts delivered to SIEM and actioned upon: https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-key-vault-planFollow the Identification and Authentication standard for further requirements on approved Password vaults and specific requirements. Additional information can be found on CDP website User Access Management
**CDP Control ID:** `35948452`
**Category:** User Access Management
**Frequency:** Biannually
**Owner:** h.noerenberg
**Parent:** #1
## Requirement & Guidance
User Access Management Requirement: Confirm uniqueness of user IDs and passwords for each individual. Individual User IDs must not be shared. Guidance: Confirm that the User Ids and Passwords in client applications are unique and personal to all the resources. Confirm that there are no common or shared IDs between resources. Passwords must be stored securely (in password vault or equivalent). For password vaults, internet access can be allowed for these if the following 3 controls are in place: Strong Auth (no access keys, secrets, RBAC integration with Entra): https://learn.microsoft.com/en-us/azure/key-vault/general/authentication KeyVault Logs must be enabled: https://learn.microsoft.com/en-us/azure/key-vault/general/logging?tabs=Vault Azure Defender for KeyVault must be used and alerts delivered to SIEM and actioned upon: https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-key-vault-planFollow the Identification and Authentication standard for further requirements on approved Password vaults and specific requirements. Additional information can be found on CDP website User Access Management
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
CDP Control ID:
35948452Category: User Access Management
Frequency: Biannually
Owner: h.noerenberg
Parent: #1
Requirement & Guidance
User Access Management Requirement: Confirm uniqueness of user IDs and passwords for each individual. Individual User IDs must not be shared. Guidance: Confirm that the User Ids and Passwords in client applications are unique and personal to all the resources. Confirm that there are no common or shared IDs between resources. Passwords must be stored securely (in password vault or equivalent). For password vaults, internet access can be allowed for these if the following 3 controls are in place: Strong Auth (no access keys, secrets, RBAC integration with Entra): https://learn.microsoft.com/en-us/azure/key-vault/general/authentication KeyVault Logs must be enabled: https://learn.microsoft.com/en-us/azure/key-vault/general/logging?tabs=Vault Azure Defender for KeyVault must be used and alerts delivered to SIEM and actioned upon: https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-key-vault-planFollow the Identification and Authentication standard for further requirements on approved Password vaults and specific requirements. Additional information can be found on CDP website User Access Management
CapaKraken Action Plan — 35948452 Unique IDs & Passwords
Scope: Eindeutige User-IDs + Passwörter, keine geteilten Logins, Passwort-Vault, MFA für Vault-Nutzung.
Aktueller Stand:
docs/acn-security-compliance-status.md3.2.2.1.01 OK — Auth.js v5 + Argon2 + TOTP MFAUser.email)Todos:
.envausserhalb Secrets-ManagerUserRole=ADMIN-Konten haben MFA aktiviertdocs/secrets-management.md(neu) + Admin-MFA-ReportDateien:
packages/api/src/router/auth/*,packages/db/prisma/schema.prisma(User model)CapaKraken Compliance-Status
EAPPS-Mapping:
3.2.2.1.01Status: ✅ OK (laut
docs/acn-security-compliance-status.md)Zusammenfassung
Jeder User hat eine eindeutige E-Mail-ID, Passwörter sind Argon2id-gehasht mit zufälligem Salt. Keine shared/default Credentials.
Nachweis
User.email @unique(Prisma) —packages/db/prisma/schema.prismapackages/api/src/router/auth.ts,scripts/setup-admin.mjs$argon2id$Hash) —scripts/import-dev-seed.mjsEntscheidung: Control ist nachweislich erfüllt → Ticket wird geschlossen.