Alibaba Cloud
TMA-ALIBABA-1.3
Ensure MFA is enabled for the "root" account
Descrição
With MFA enabled, anytime the "root" account logs on to Alibaba Cloud, it will be prompted for username and password followed by an authentication code from the virtual MFA device. It is recommended that MFA be enabled for the "root" user. It is important to prevent "root" account from being compromised. Enabling MFA requires the "root" account holder to provide additional information on top of username and password. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.
Como é verificado
Método de auditoria: Revisão manual
Perform the following to determine if an MFA device is enabled for the "root" account: Using the management console: 1. Logon to RAM console by using your Alibaba Cloud account (root account). 2. In the left-side navigation pane, click Overview. 3. In the Security Check section, make sure that Enable MFA for Root Account is marked as Finished.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Perform the following to enable MFA for "root" account Using the management console: 1. Logon to RAM console by using your Alibaba Cloud account (root account). 2. Move the pointer over the account icon in the upper-right corner and click Security Settings. 3. In the Account Protection section, Click Edit. 4. On the displayed page, select a scenario and select TOTP. 5. Click Submit. 6. On the displayed page, click Verify now. 7. Enter the verification code and click Submit. 8. Download and install a mobile application that supports TOTP MFA, such as Google Authenticator, on your mobile phone. Note: If you already installed Google Authenticator, click Next.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- alibabaram
- Referência
- CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 1.3 Ensure MFA is enabled for the "root" account