Ensure Integration Account Secrets Are Rotated on a Regular Schedule

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

1. Review integration accounts in Oracle Fusion Applications and identify all OAuth clients, JWT keys, and certificates in use. 2. Confirm that each credential has a documented rotation policy, including expiration and renewal dates. 3. Validate logs or change records to confirm that credentials have been rotated within the organization's defined schedule (for example, within the past 180 days). 4. Check for expired or inactive credentials and confirm they are removed from production environments.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Develop an inventory of all integration account secrets, including OAuth credentials, JWT keys, and certificates. 2. Define a rotation schedule (for example, 90 or 180 days) aligned with organizational policy and compliance requirements. 3. Rotate each credential according to the schedule, updating dependent integrations and notifying stakeholders. 4. Remove or revoke any unused or expired credentials to reduce the attack surface. 5. Document the process and maintain records of all credential rotations for audit purposes.