TMA-GWS-4.1.1.1
Ensure 2-Step Verification (Multi-Factor Authentication) is enforced for all users in administrative roles
Descrição
Enforce 2-Step Verification (Multi-Factor Authentication) for all users assigned administrative roles. These include roles such as: - Help Desk Admin - Groups Admin - Super Admin - Services Admin - User Management Admin - Mobile Admin - Android Admin - Custom Admin Roles Add an extra layer of security to users accounts by asking users to verify their identity when they enter a username and password. 2-Step Verification (Multi-factor authentication) requires an individual to present a minimum of two separate forms of authentication before access is granted. 2-Step Verification provides additional assurance that the individual attempting to gain access is who they claim to be. With 2- Step Verification, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.
Como é verificado
Método de auditoria: Revisão manual
Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.
To verify this setting via the Google Admin Console: 1. Log in to https://admin.google.com as an administrator 2. Go to Security and click on 2-Step Verification 3. Select the appropriate group with ALL ADMIN ROLES -- Create this group if needed 4. Under Authentication, ensure Allow users to turn on 2-Step Verification is checked 5. Ensure Enforcement is set to On 6. Ensure New user enrollment period is set to 2 weeks 7. Under Frequency, ensure Allow user to trust device is unchecked 8. Under Methods, ensure Any except verification codes via text, phone call is selected
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
To verify this setting via the Google Admin Console: 1. Log in to https://admin.google.com as an administrator 2. Go to Security and click on 2-Step Verification 3. Select the appropriate group with ALL ADMIN ROLES -- Create this group if needed 4. Under Authentication, set Allow users to turn on 2-Step Verification to checked 5. Set Enforcement to On 6. Set New user enrollment period is set to 2 weeks 7. Under Frequency, set Allow user to trust device to unchecked 8. Under Methods, set Any except verification codes via text, phone call to selected 9. Select Save
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- authgoogle-workspaceiamsaas
- Referência
- CIS Google Workspace Foundations Benchmark v1.4.0 - 4.1.1.1 Ensure 2-Step Verification (Multi-Factor Authentication) is enforced for all users in administrative roles