1.3.8 Ensure strict base permissions are set for repositories
ID |
cis_sscs/org_default_repo_permission |
Severity |
critical |
Category |
source_code/contribution_access |
Levels |
|
Optional |
false |
Tags |
least-privilege, security, slsa-4, supply-chain |
Description
Base permissions define the permission level automatically granted to all organization members. Define strict base access permissions for all the repositories in the organization, including new ones.
Rationale
Defining strict base permissions is the best practice in every role-based access control (RBAC) system. If the base permission is high — for example, "write" permission — every member of the organization will have "write" permission to every repository in the organization.
This will apply regardless of the specific permissions a user might need, which generally differ between organization repositories. The higher the permission, the higher the risk for incidents such as bad code commit or data breach.
It is therefore recommended to set the base permissions to the strictest level possible.