TMA-ORACLE-SAAS-1.12
Ensure EPM Automate Credentials Are Protected via Secure Storage
Mô tả
EPM Automate requires credentials to execute commands such as data load, snapshot management, or audit log export. These credentials must never be stored in plaintext within scripts or configuration files. Storing credentials in plaintext exposes privileged accounts to theft and misuse. EPM Automate is commonly executed with Service Administrator-level rights, making it a high-value target. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
1. Review all automation scripts, scheduled jobs, and CI/CD processes invoking EPM Automate. 2. Verify that credentials are not stored in cleartext (e.g. in batch files, shell scripts, or parameters). 3. Confirm that either: The Oracle encrypted password file is being used, or Credentials are retrieved securely from an OS-level key store (e.g. Windows Credential Manager, Linux keyring) or an enterprise vault (e.g. CyberArk, HashiCorp Vault, OCI Vault). 4. Validate that credential rotation is in place and documented.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Use the EPM Automate encrypt command to generate an encrypted password file and update scripts to reference it instead of plaintext arguments. Alternatively, configure integration with an enterprise password vault or OS secure key store to inject credentials at runtime. Regularly rotate credentials and regenerate encrypted storage files. Audit existing automation jobs to ensure compliance and remove any residual plaintext credentials.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- oracle-saasidentity
- Tham chiếu
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.12 Ensure EPM Automate Credentials Are Protected via Secure Storage