TMA-GWS-4.1.1.1
Ensure 2-Step Verification (Multi-Factor Authentication) is enforced for all users in administrative roles
Açıklama
Enforce 2-Step Verification (Multi-Factor Authentication) for all users assigned administrative roles. These include roles such as: - Help Desk Admin - Groups Admin - Super Admin - Services Admin - User Management Admin - Mobile Admin - Android Admin - Custom Admin Roles Add an extra layer of security to users accounts by asking users to verify their identity when they enter a username and password. 2-Step Verification (Multi-factor authentication) requires an individual to present a minimum of two separate forms of authentication before access is granted. 2-Step Verification provides additional assurance that the individual attempting to gain access is who they claim to be. With 2- Step Verification, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
To verify this setting via the Google Admin Console: 1. Log in to https://admin.google.com as an administrator 2. Go to Security and click on 2-Step Verification 3. Select the appropriate group with ALL ADMIN ROLES -- Create this group if needed 4. Under Authentication, ensure Allow users to turn on 2-Step Verification is checked 5. Ensure Enforcement is set to On 6. Ensure New user enrollment period is set to 2 weeks 7. Under Frequency, ensure Allow user to trust device is unchecked 8. Under Methods, ensure Any except verification codes via text, phone call is selected
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
To verify this setting via the Google Admin Console: 1. Log in to https://admin.google.com as an administrator 2. Go to Security and click on 2-Step Verification 3. Select the appropriate group with ALL ADMIN ROLES -- Create this group if needed 4. Under Authentication, set Allow users to turn on 2-Step Verification to checked 5. Set Enforcement to On 6. Set New user enrollment period is set to 2 weeks 7. Under Frequency, set Allow user to trust device to unchecked 8. Under Methods, set Any except verification codes via text, phone call to selected 9. Select Save
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- authgoogle-workspaceiamsaas
- Referans
- CIS Google Workspace Foundations Benchmark v1.4.0 - 4.1.1.1 Ensure 2-Step Verification (Multi-Factor Authentication) is enforced for all users in administrative roles