Detections
Analytics

CSCv6|16.6

Title

Monitor account usage to determine dormant accounts, notifying the user or user's manager.

Description

Monitor account usage to determine dormant accounts, notifying the user or user's manager. Disable such accounts if not needed, or document and monitor exceptions (e.g., vendor maintenance accounts needed for system recovery or continuity operations). Require that managers match active employees and contractors with each account belonging to their managed staff. Security or system administrators should then disable accounts that are not assigned to valid workforce members.

Reference Item Details

Category: Account Monitoring and Control

Family: Application

Audit Items

View all Reference Audit Items

NamePluginAudit Name
5.4.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Debian 9 Server L1 v1.0.1
5.4.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Debian 9 Workstation L1 v1.0.1
5.4.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Debian Family Workstation L1 v1.0.0
5.4.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Amazon Linux v2.1.0 L1
5.4.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Debian Family Server L1 v1.0.0
5.4.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Aliyun Linux 2 L1 v1.0.0
5.4.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Debian Family Workstation L1 v1.0.0
5.4.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Aliyun Linux 2 L1 v1.0.0
5.4.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Amazon Linux v2.1.0 L1
5.4.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Debian 9 Server L1 v1.0.1
5.4.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Debian Family Server L1 v1.0.0
5.4.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Debian 9 Workstation L1 v1.0.1
5.5.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Red Hat 6 Workstation L1 v3.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Red Hat 6 Server L1 v3.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Oracle Linux 6 Workstation L1 v2.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS Oracle Linux 6 Server L1 v2.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS CentOS 6 Server L1 v3.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - useraddUnixCIS CentOS 6 Workstation L1 v3.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Oracle Linux 6 Workstation L1 v2.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Red Hat 6 Server L1 v3.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS CentOS 6 Workstation L1 v3.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS CentOS 6 Server L1 v3.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Red Hat 6 Workstation L1 v3.0.0
5.5.1.4 Ensure inactive password lock is 30 days or less - usersUnixCIS Oracle Linux 6 Server L1 v2.0.0
7.5 Lock Inactive User Accounts - INACTIVE=35UnixCIS Red Hat Enterprise Linux 5 L1 v2.2.1
7.6 Lock Inactive User Accounts - useradd -D, 35UnixCIS Solaris 11.2 L1 v1.1.0
7.6 Lock Inactive User Accounts - useradd -D, 35UnixCIS Solaris 11.1 L1 v1.0.0
7.6 Lock Inactive User Accounts - useradd -D, 35UnixCIS Solaris 11 L1 v1.1.0
7.9 Lock Inactive User Accounts - Check if definact is set to 35.UnixCIS Solaris 10 L1 v5.2
10.5 Lock Inactive User AccountsUnixCIS Debian Linux 7 L1 v1.0.0
10.5 Lock Inactive User AccountsUnixCIS Ubuntu 12.04 LTS Benchmark L1 v1.1.0
Ensure inactive password lock is 30 days or lessUnixTenable Cisco Firepower Management Center OS Best Practices Audit