Detections
Analytics

2.11 Lock Out Accounts if Not Currently in Use

Information

Accounts that are dormant, potentially compromised, or under attack may be locked to prevent access without removing the account or its privileges. Locked accounts can be unlocked when access needs to be restored.

Only have active accounts that will be used.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To lock accounts - example:

ALTER USER 'jeffrey'@'localhost' ACCOUNT LOCK;

To unlock accounts - example

ALTER USER 'jeffrey'@'localhost' ACCOUNT UNLOCK;

Note: Works for CREATE as well. It is good practice to LOCK an account if created ahead of time.

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(3), CSCv7|16.9

Plugin: MySQLDB

Control ID: 2a6676540c50843c1b47e7dfa078511371c7547ddb749825f4ef3b5f182a75f2