Ensure OCI IAM credentials unused for 45 days or more are disabled

CaoCấp 1Xem xét thủ côngoci

Mô tả

OCI IAM Local users can access OCI resources using different credentials, such as passwords or API keys. It is recommended that credentials that have been unused for 45 days or more be deactivated or removed. Disabling or removing unnecessary OCI IAM local users will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Perform the following to determine if unused credentials exist: From Console: For Passwords: 1. Login to OCI Console. 2. Select Identity & Security from the Services menu. 3. Select Domains from the Identity menu. 4. For each domain listed, click on the name 5. Click Reports 6. Under Dormant users report click View report 7. Enter a date 45 days from today's date in Last Successful Login Date 8. Check and ensure that Last Successful Login Date is greater than 45 days or empty For API Keys: 1. Login to OCI Console. 2. Select Observability & Management from the Services menu. 3.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

From Console: 1. Login to OCI Console. 2. Select Identity & Security from the Services menu. 3. Select Domains from the Identity menu. 4. For each domain listed, click on the name and select Users. 5. Click on an individual user under the Username heading. 6. Click More action 7. Select Deactivate From CLI: 1. Create a input.json: { "operations": [ { "op": "replace", "path": "active","value": false} ], "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "userId": "<user-ocid>" } 2. Execute the below: oci identity-domains user patch --from-json file://file.json --endpoint <identity-domain-endpoint>

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: ociiam
Tham chiếu: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.16 Ensure OCI IAM credentials unused for 45 days or more are disabled