The Dragos Platform must only allow local administrative and service user accounts.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-270919	SRG-APP-000080	DRAG-OT-000240	SV-270919r1155099_rule	2025-11-25	1

Description
Only default accounts facilitate the initial setup and configuration of the Platform. These accounts provide immediate access to the system, allowing administrators to quickly get the system up and running without needing to create new user accounts during the initial installation phase. These accounts are: UI Administrator, DragOS CLI standard user (dragos), DragOS CLI admin context user (dragos_admin) or user created authorized accounts. During maintenance, updates, or support operations, default accounts allow vendor support teams to access the system without needing to manage a variety of customer-specific accounts. This can streamline support activities and reduce downtime. Default accounts passwords need to be protected so they cannot be exploited by attackers to gain unauthorized access to the system. Satisfies: SRG-APP-000080, SRG-APP-000234

Description

Only default accounts facilitate the initial setup and configuration of the Platform. These accounts provide immediate access to the system, allowing administrators to quickly get the system up and running without needing to create new user accounts during the initial installation phase. These accounts are: UI Administrator, DragOS CLI standard user (dragos), DragOS CLI admin context user (dragos_admin) or user created authorized accounts. During maintenance, updates, or support operations, default accounts allow vendor support teams to access the system without needing to manage a variety of customer-specific accounts. This can streamline support activities and reduce downtime. Default accounts passwords need to be protected so they cannot be exploited by attackers to gain unauthorized access to the system. Satisfies: SRG-APP-000080, SRG-APP-000234

ℹ️ Check
Verify local user accounts. While logged in to the Dragos Platform UI with a user account with administrative privileges, navigate to Admin >> User Management >> Users. If any local user except the UI Administrator, DragOS CLI standard user (dragos), DragOS CLI admin context user (dragos_admin), or user-created authorized accounts exist, this is a finding.

✔️ Fix
Remove users except the UI Administrator, DragOS CLI Service Accounts, and user-created authorized user accounts.. While logged in to the Dragos Platform UI with a user account with administrative privileges, navigate to Admin >> User Management >> Users. Click the kebab menu next to the user and select "Delete User". Click "DELETE" in the verification window. If using SSO/OIDC, removing the username/password authentication provider is sufficient when a user has multiple authentication providers. For DragOS Cli: run the command "system users show" to verify only built-in and user created/authorized accounts are present. To remove unwanted accounts, run the command "configu user remove <username>". Note: Any accounts not built-in or managed by the CLI will be removed when configuration is applied.

✔️ Fix

Remove users except the UI Administrator, DragOS CLI Service Accounts, and user-created authorized user accounts.. While logged in to the Dragos Platform UI with a user account with administrative privileges, navigate to Admin >> User Management >> Users. Click the kebab menu next to the user and select "Delete User". Click "DELETE" in the verification window. If using SSO/OIDC, removing the username/password authentication provider is sufficient when a user has multiple authentication providers. For DragOS Cli: run the command "system users show" to verify only built-in and user created/authorized accounts are present. To remove unwanted accounts, run the command "configu user remove <username>". Note: Any accounts not built-in or managed by the CLI will be removed when configuration is applied.