V-252579

Discussion

Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.

Check Content

If the IBM Aspera Faspex feature of the Aspera Platform is not installed, this is Not Applicable.

Verify IBM Aspera Faspex disables account identifiers after 35 days of inactivity: 

- Log in to the IBM Aspera Faspex web page as a user with administrative privilege. 
- Select the "Server" tab.
- Select the "Configuration" tab.
- Select the "Security" section.
- Under the "Faspex accounts" "Remove users" section, verify the following:
- Verify the "Local users" option is checked.
- Verify the "Local users" options is set to "35" days or less.
- Verify the "DS users" option is checked.
- Verify the "DS users" options is set to "35" days or less.
- Verify the "SAML users" option is checked.
- Verify the "SAML users" options is set to "35" days or less.

If the "Local users" options is set to more than "35" days or the option is not checked, this is a finding.

If the "DS users" options is set to more than "35" days or the option is not checked, this is a finding.

If the "SAML users" options is set to more than "35" days or the option is not checked, this is a finding.