Ensure Integration Account Secrets Are Rotated on a Regular Schedule

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

1. Review integration accounts in Oracle Fusion Applications and identify all OAuth clients, JWT keys, and certificates in use. 2. Confirm that each credential has a documented rotation policy, including expiration and renewal dates. 3. Validate logs or change records to confirm that credentials have been rotated within the organization's defined schedule (for example, within the past 180 days). 4. Check for expired or inactive credentials and confirm they are removed from production environments.

修正方法

修正方法: ガイダンスまたは IaC パッチ

1. Develop an inventory of all integration account secrets, including OAuth credentials, JWT keys, and certificates. 2. Define a rotation schedule (for example, 90 or 180 days) aligned with organizational policy and compliance requirements. 3. Rotate each credential according to the schedule, updating dependent integrations and notifying stakeholders. 4. Remove or revoke any unused or expired credentials to reduce the attack surface. 5. Document the process and maintain records of all credential rotations for audit purposes.