Weak authentication service in use

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_49
Category	IAM
Severity	MEDIUM

Impact

Jenkins provides built-in methods for authentication of users, such as a Jenkins' own user database, or a Unix user/group database. These methods lack basic security controls which are essential to assure the immunity of the system, such as enforcing a password policy, controls against Brute Force attacks, and requiring 2FA. These weak authentication methods might expose the organization to a wide variety of authentication-based attacks.

Recommended Solution - Buildtime

Implement a secure authentication mechanism which provides security controls that meet the industry best practices, such as integrating with the organization’s SSO solution. For more on secure authentication mechanisms refer to https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html.