Prevent users from accessing the terminal on MLDE instances to limit the risk of unauthorized commands and potential system compromise.
Disable Terminal Access on MLDE Instances
CCC.MLDE.CN04 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.MLDE.CP01 | Managed Notebook Environments | Provides fully managed notebook instances specifically designed for machine learning development, eliminating the need to manage underlying infrastructure. |
| CCC.Core.CP06 | Access Control | The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.MLDE.TH01 | Elevated System Access on Notebook Instances is Abused | Managed notebook instances may be configured to permit root privileges, interactive terminal sessions, or unrestricted access modes for the users of the environment. When such access is available, the underlying instance configuration could be modified, security agents disabled, or arbitrary commands executed outside the notebook interface. This compromises the integrity of the development environment and the confidentiality of any data or credentials accessible from the instance. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.MLDE.CN04.AR01 | Verify that terminal access is disabled on MLDE instances containing sensitive data. | tlp-red |
| CCC.MLDE.CN04.AR02 | For MLDE instances without sensitive data, ensure that terminal access is only enabled when necessary and properly authorized. | tlp-red, tlp-amber, tlp-green, tlp-clear |
Guideline Mappings
| Framework | ID | Remarks |
|---|---|---|
| NIST-CSF | PR.AC-4 | |
| NIST_800_53 | AC-6 | |
| CCM | IAM-08 | |
| ISO_27001 | 2013 A.9.2.3 |