Join the Reckless Community* indicates requiredEmail Address *First Name *Last Name *
Back to Application Server Security Requirements Guide
Severity: Medium
<VulnDiscussion>Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Verify the application server disables accounts when the accounts are no longer associated to a user. If the application server does not disable accounts when the accounts are no longer associated to a user, this is a finding.
Configure the application server to disable accounts when the accounts are no longer associated to a user.