Control: 1.1 Monitor account owner for frequent, unexpected, or unauthorized logins

Description

Monitor login activity of the account owner to prevent unauthorized usage of the privileged account.

Remediation

From Console

Complete the following steps to monitor how many times an account owner logs in to the account:

First, you need to identify the email of the account owner.

1. Log in to IBM Cloud.
2. In the Cloud UI, go to Manage > Access (IAM), then select Users.
3. Identify the user that has the tag owner.
4. Select the account owner. Then, click Details.
5. Copy the email address of the account owner

Launch the Activity Tracker instance in Frankfurt. This is the instance where login security events are collected in the account. In the Views section, select the Everything view. Then, enter the following query in the search bar: (action login) AND initiator.name: email address. Replace with the account owner's email address. The view now reports all the login actions that are reported for the account owner. Next, you can define an alert on the view to get a notification when N number of events are received within a 24 hour period. The value of N depends on how you operate your cloud. You can start with a default value of 25 and increase or decrease depending on the tasks that the account administrator cam perform in the account.