Ensure EPM Automate Credentials Are Protected via Secure Storage

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

1. Review all automation scripts, scheduled jobs, and CI/CD processes invoking EPM Automate. 2. Verify that credentials are not stored in cleartext (e.g. in batch files, shell scripts, or parameters). 3. Confirm that either: The Oracle encrypted password file is being used, or Credentials are retrieved securely from an OS-level key store (e.g. Windows Credential Manager, Linux keyring) or an enterprise vault (e.g. CyberArk, HashiCorp Vault, OCI Vault). 4. Validate that credential rotation is in place and documented.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Use the EPM Automate encrypt command to generate an encrypted password file and update scripts to reference it instead of plaintext arguments. Alternatively, configure integration with an enterprise password vault or OS secure key store to inject credentials at runtime. Regularly rotate credentials and regenerate encrypted storage files. Audit existing automation jobs to ensure compliance and remove any residual plaintext credentials.