TMA-ORACLE-SAAS-1.3
Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts
Descripción
Multi-Factor Authentication (MFA) requires users to present an additional verification factor beyond username and password. In Oracle Fusion environments, native MFA enforcement via Identity Domain sign-on policies functions only after the environment's identity service is upgraded to OCI IAM or an external IdP. Privileged accounts are high-value targets. Enforcing MFA with phishing resistant factors reduces the risk of unauthorized administrative access even if credentials are compromised. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
1. Determine if the Fusion environment has been upgraded to use OCI IAM (check Fusion environment's maintenance/upgrade status) or is using an external IdP for MFA. 2. Access the Security Console User Categories Two-Factor Authentication and confirm SaaS administrators/privileged categories have MFA enabled. Only enable factors that are considered phishing resistant. 3. If identity upgrade has not occurred, verify that MFA is enforced via the external IdP for privileged accounts. 4. Test login with a privileged account and confirm MFA prompt is required (native or via IdP).
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
1. If identity upgrade is not finalized implement MFA via the external IdP. 2. After the upgrade, in the Security Console open User Categories Two-Factor Authentication and enable MFA for administrator/privileged categories. 3. Define valid phishing resistant MFA factors (mobile authenticator, FIDO, etc.). 4. Save settings and ensure SaaS users enroll in MFA during their next login. 5. Test that privileged accounts require MFA (OCI IAM) and fallback to IdP enrollment where needed.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- oracle-saasidentity
- Referencia
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.3 Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts