Ensure Integration Account Secrets Are Rotated on a Regular Schedule

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

1. Review integration accounts in Oracle Fusion Applications and identify all OAuth clients, JWT keys, and certificates in use. 2. Confirm that each credential has a documented rotation policy, including expiration and renewal dates. 3. Validate logs or change records to confirm that credentials have been rotated within the organization's defined schedule (for example, within the past 180 days). 4. Check for expired or inactive credentials and confirm they are removed from production environments.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

1. Develop an inventory of all integration account secrets, including OAuth credentials, JWT keys, and certificates. 2. Define a rotation schedule (for example, 90 or 180 days) aligned with organizational policy and compliance requirements. 3. Rotate each credential according to the schedule, updating dependent integrations and notifying stakeholders. 4. Remove or revoke any unused or expired credentials to reduce the attack surface. 5. Document the process and maintain records of all credential rotations for audit purposes.