STIGQter: STIG Summary: Dragos Platform 2.x Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Apr 2026:

The Dragos Platform must only allow local administrative and service user accounts.

DISA Rule

SV-270919r1190805_rule

Vulnerability Number

V-270919

Group Title

SRG-APP-000080

Rule Version

DRAG-OT-000240

Severity

CAT II

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-001682 - Automatically removes or disables emergency accounts after an organization-defined time period for each type of account.

Weight

10

Fix Recommendation

Remove any nondefault user accounts configured to authenticate with username and password or configure an approved identity provider for all required user accounts.

1.Remove user:
While logged in to the Dragos Platform with a user account with administrative privileges, navigate to Admin >> User Management >> Users.
Click the kebab menu next to the user and select "Delete User".
Click "DELETE" in the verification window.

2. Add Authentication method:
While logged in to the Dragos Platform with a user account with administrative privileges, navigate to Admin >> User Management >> Users.
Click the kebab menu next to the user and select "Edit User".
Click "Authentication" in the page selector.
Add information to appropriate authentication method and click "Save".

Check Contents

Verify local user accounts.

While logged in to the Dragos Platform with a user account with administrative privileges, navigate to Admin >> User Management >> Users.

If any user except the UI administrator account is configured to authenticate with username and password, this is a finding.

Vulnerability Number

V-270919

Documentable

False

Rule Version

DRAG-OT-000240

Severity Override Guidance

Verify local user accounts.

While logged in to the Dragos Platform with a user account with administrative privileges, navigate to Admin >> User Management >> Users.

If any user except the UI administrator account is configured to authenticate with username and password, this is a finding.

Check Content Reference

M

Target Key

5675