← All keys & policies
Key·enterprise
Management Console access (Enterprise Server)
Tier 0 · CriticalControl
Why Tier 0
Configures the whole GitHub Enterprise Server instance, including authentication. The root site administrator and Management Console users sit above every organization and enterprise role on the instance.
Access to the Enterprise Server Management Console, held by the root site administrator and any Management Console users they create.
Available on: Server. Source
Attack path
Whoever signs in to the Management Console can change authentication for the instance, so every other control on it depends on this credential.
Mitigations
- Limit Management Console users and keep the root site administrator's credentials offline
- Restrict network access to the Management Console
Detect
Nothing in the organization or enterprise audit log shows this. Review it on a schedule instead.