TMA-ORACLE-SAAS-1.3
Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts
Описание
Multi-Factor Authentication (MFA) requires users to present an additional verification factor beyond username and password. In Oracle Fusion environments, native MFA enforcement via Identity Domain sign-on policies functions only after the environment's identity service is upgraded to OCI IAM or an external IdP. Privileged accounts are high-value targets. Enforcing MFA with phishing resistant factors reduces the risk of unauthorized administrative access even if credentials are compromised. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
Как проверяется
Метод проверки: Ручная проверка
Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.
1. Determine if the Fusion environment has been upgraded to use OCI IAM (check Fusion environment's maintenance/upgrade status) or is using an external IdP for MFA. 2. Access the Security Console User Categories Two-Factor Authentication and confirm SaaS administrators/privileged categories have MFA enabled. Only enable factors that are considered phishing resistant. 3. If identity upgrade has not occurred, verify that MFA is enforced via the external IdP for privileged accounts. 4. Test login with a privileged account and confirm MFA prompt is required (native or via IdP).
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
1. If identity upgrade is not finalized implement MFA via the external IdP. 2. After the upgrade, in the Security Console open User Categories Two-Factor Authentication and enable MFA for administrator/privileged categories. 3. Define valid phishing resistant MFA factors (mobile authenticator, FIDO, etc.). 4. Save settings and ensure SaaS users enroll in MFA during their next login. 5. Test that privileged accounts require MFA (OCI IAM) and fallback to IdP enrollment where needed.
Свойства
- Операционные системы
- Любая
- Теги
- oracle-saasidentity
- Источник
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.3 Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts