Ensure Integration Account Secrets Are Rotated on a Regular Schedule

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

1. Review integration accounts in Oracle Fusion Applications and identify all OAuth clients, JWT keys, and certificates in use. 2. Confirm that each credential has a documented rotation policy, including expiration and renewal dates. 3. Validate logs or change records to confirm that credentials have been rotated within the organization's defined schedule (for example, within the past 180 days). 4. Check for expired or inactive credentials and confirm they are removed from production environments.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

1. Develop an inventory of all integration account secrets, including OAuth credentials, JWT keys, and certificates. 2. Define a rotation schedule (for example, 90 or 180 days) aligned with organizational policy and compliance requirements. 3. Rotate each credential according to the schedule, updating dependent integrations and notifying stakeholders. 4. Remove or revoke any unused or expired credentials to reduce the attack surface. 5. Document the process and maintain records of all credential rotations for audit purposes.