TMA-GWS-4.1.1.1

Ensure 2-Step Verification (Multi-Factor Authentication) is enforced for all users in administrative roles

높음레벨 1수동 검토google-workspace

설명

Enforce 2-Step Verification (Multi-Factor Authentication) for all users assigned administrative roles. These include roles such as: - Help Desk Admin - Groups Admin - Super Admin - Services Admin - User Management Admin - Mobile Admin - Android Admin - Custom Admin Roles Add an extra layer of security to users accounts by asking users to verify their identity when they enter a username and password. 2-Step Verification (Multi-factor authentication) requires an individual to present a minimum of two separate forms of authentication before access is granted. 2-Step Verification provides additional assurance that the individual attempting to gain access is who they claim to be. With 2- Step Verification, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

To verify this setting via the Google Admin Console: 1. Log in to https://admin.google.com as an administrator 2. Go to Security and click on 2-Step Verification 3. Select the appropriate group with ALL ADMIN ROLES -- Create this group if needed 4. Under Authentication, ensure Allow users to turn on 2-Step Verification is checked 5. Ensure Enforcement is set to On 6. Ensure New user enrollment period is set to 2 weeks 7. Under Frequency, ensure Allow user to trust device is unchecked 8. Under Methods, ensure Any except verification codes via text, phone call is selected

조치 방법

조치 방식: 가이드 또는 인프라 패치

To verify this setting via the Google Admin Console: 1. Log in to https://admin.google.com as an administrator 2. Go to Security and click on 2-Step Verification 3. Select the appropriate group with ALL ADMIN ROLES -- Create this group if needed 4. Under Authentication, set Allow users to turn on 2-Step Verification to checked 5. Set Enforcement to On 6. Set New user enrollment period is set to 2 weeks 7. Under Frequency, set Allow user to trust device to unchecked 8. Under Methods, set Any except verification codes via text, phone call to selected 9. Select Save

속성

운영 체제: 모두
태그: authgoogle-workspaceiamsaas
참고 자료: CIS Google Workspace Foundations Benchmark v1.4.0 - 4.1.1.1 Ensure 2-Step Verification (Multi-Factor Authentication) is enforced for all users in administrative roles