TMA-ORACLE-SAAS-1.3
Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts
Deskripsi
Multi-Factor Authentication (MFA) requires users to present an additional verification factor beyond username and password. In Oracle Fusion environments, native MFA enforcement via Identity Domain sign-on policies functions only after the environment's identity service is upgraded to OCI IAM or an external IdP. Privileged accounts are high-value targets. Enforcing MFA with phishing resistant factors reduces the risk of unauthorized administrative access even if credentials are compromised. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
1. Determine if the Fusion environment has been upgraded to use OCI IAM (check Fusion environment's maintenance/upgrade status) or is using an external IdP for MFA. 2. Access the Security Console User Categories Two-Factor Authentication and confirm SaaS administrators/privileged categories have MFA enabled. Only enable factors that are considered phishing resistant. 3. If identity upgrade has not occurred, verify that MFA is enforced via the external IdP for privileged accounts. 4. Test login with a privileged account and confirm MFA prompt is required (native or via IdP).
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
1. If identity upgrade is not finalized implement MFA via the external IdP. 2. After the upgrade, in the Security Console open User Categories Two-Factor Authentication and enable MFA for administrator/privileged categories. 3. Define valid phishing resistant MFA factors (mobile authenticator, FIDO, etc.). 4. Save settings and ensure SaaS users enroll in MFA during their next login. 5. Test that privileged accounts require MFA (OCI IAM) and fallback to IdP enrollment where needed.
Properti
- Sistem operasi
- Apa saja
- Tag
- oracle-saasidentity
- Referensi
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.3 Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts