Inactive SCM user accounts

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_16
Category	IAM
Severity	MEDIUM

Impact

A user account in the source control management (SCM) system has been inactive for over 30 days. Such accounts may be exploited by an adversary who has compromised the credentials, potentially gaining access to sensitive resources and manipulating critical data or processes.

Recommended Solution - Buildtime

We recommend removing or disabling inactive user accounts to minimize the attack and risk surface related to the GitLab workspace.