Skip to main content

Security review

Security review, under Overview in the Nomasx-1 menu, is the page for an access review: it lists what is wrong in the access of each connected application, the accounts to look at first, and the screens where to act.

At a glance​

Security reviewAPPLICATIONAll ▾Enabled accountsCan sign in38041 dormant · 12 never logged inPrivileged accountsEnabled, super-user62 unused for 90 daysMissing from the directoryNo directory account7LDAP collectedOpen to ∗PUBLICEvery user can run them5411 users with own rightsThe checksRed first, green when cleanPrivileged accounts left dormant2Enabled accounts missing from the directory7Directory account expired, still enabled1Dormant enabled accounts41Generic / shared accounts enabled3Several accounts for one person0Accounts to review firstThe figure is the days since the last loginJDOEprivileged · dormant212MLEROYmissing from the directory18BATCH01generic account3PDURANDnever logged in—Four figuresaccounts, privileges, directory, ∗PUBLICTwelve checkscount and severityAccounts firstthe ones to act on

The four figures​

CardFigureDetail line
Enabled accounts — accounts that can sign inThe enabled accounts.Dormant — no login for 90 days — and never logged in.
Privileged accounts — enabled, with super-user accessThe enabled privileged accounts.Those unused for 90 days.
Missing from the directory — enabled named accounts with no directory accountThe accounts no directory entry matches.Whether the directory is collected.
Open to *PUBLIC — objects every user can runThe objects granted to *PUBLIC.The users holding rights of their own.

The Application filter works as on the other dashboards: All gives the totals.

The checks​

Each check with its count, red first, green when there is nothing to report.

CheckSeverityWhat to do
Privileged accounts left dormantRedSuper-user access unused for 90 days: disable it or re-certify its owner.
Enabled accounts missing from the directoryRedNo matching directory account: a leaver, or an account nobody owns.
Directory account expired, still enabledRedThe person's directory account has expired: disable the account.
Dormant enabled accountsOrangeNo login within 90 days: disable or re-certify.
Never used after a monthOrangeCreated over 30 days ago and never logged in: provisioned by mistake, or no longer needed.
Generic / shared accounts enabledOrangeActions cannot be traced to a person: replace them by named accounts.
Several accounts for one personOrangeEnabled accounts sharing an address book number: keep one per person.
Objects open to *PUBLICOrangeEvery user can use these objects by default: confirm none is sensitive.
Rights given to users directlyBlueRights set on a user instead of a role, outside role-based control.
Enabled accounts without rolesBlueIncomplete provisioning, or accounts to disable.
Expired role assignments on fileBlueAssignments past their expiry date: clean them up.
Orphan rolesBlueRoles assigned to nobody: remove or repurpose them.

The two directory checks need the directory collected — the Everything collection, or the LDAP step switched on; until then they say No directory collected.

The accounts and the objects​

WidgetShows
Accounts to review firstThe privileged and dormant accounts, the leavers, the generic accounts; the figure is the days since the last login.
Last loginThe enabled accounts by time since their last login: within 30 days, 30 to 90 days, 3 to 12 months, over a year, never.
Objects open to *PUBLICThe objects every user can run, those that also allow changes first.
Act on itLinks to the screens behind each check: Users, Users without AD, Duplicate users, Users without roles, Roles not used, Users properties.