TMA-ORACLE-SAAS-1.3
Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts
Opis
Multi-Factor Authentication (MFA) requires users to present an additional verification factor beyond username and password. In Oracle Fusion environments, native MFA enforcement via Identity Domain sign-on policies functions only after the environment's identity service is upgraded to OCI IAM or an external IdP. Privileged accounts are high-value targets. Enforcing MFA with phishing resistant factors reduces the risk of unauthorized administrative access even if credentials are compromised. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
Kako se proverava
Metod provere: Ručni pregled
Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.
1. Determine if the Fusion environment has been upgraded to use OCI IAM (check Fusion environment's maintenance/upgrade status) or is using an external IdP for MFA. 2. Access the Security Console User Categories Two-Factor Authentication and confirm SaaS administrators/privileged categories have MFA enabled. Only enable factors that are considered phishing resistant. 3. If identity upgrade has not occurred, verify that MFA is enforced via the external IdP for privileged accounts. 4. Test login with a privileged account and confirm MFA prompt is required (native or via IdP).
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
1. If identity upgrade is not finalized implement MFA via the external IdP. 2. After the upgrade, in the Security Console open User Categories Two-Factor Authentication and enable MFA for administrator/privileged categories. 3. Define valid phishing resistant MFA factors (mobile authenticator, FIDO, etc.). 4. Save settings and ensure SaaS users enroll in MFA during their next login. 5. Test that privileged accounts require MFA (OCI IAM) and fallback to IdP enrollment where needed.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- oracle-saasidentity
- Referenca
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.3 Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts