Ensure user access to the package registry utilizes Multi-Factor Authentication (MFA)

HighLevel 1Manual reviewsupply-chain

Description

Enforce Multi-Factor Authentication (MFA) for user access to the package registry. By default, every user authenticates to the system by password only. If a user’s password is compromised, the user account and all its related packages are in danger of data theft and malicious builds. It is therefore recommended that each user enables Multi-Factor Authentication. This additional step guarantees that the account stays secure even if the user’s password is compromised, as it adds another layer of authentication.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

For each package registry in use, verify that Multi-Factor Authentication is enforced and is the only way to authenticate.

How it is fixed

Fix method: Guidance or infrastructure patch

For each package registry in use, enforce Multi-Factor Authentication as the only way to authenticate. 50 CIS Software Supply Chain Security Guide

Properties

Operating systems: Any
Tags: access-controlauthdevsecopsmfasupply-chain
Reference: CIS Software Supply Chain Security Guide Benchmark v1.0.0 - 4.2.3 Ensure user access to the package registry utilizes Multi-Factor Authentication (MFA)