Oracle Fusion Cloud (SaaS)
TMA-ORACLE-SAAS-1.1
Ensure Password Policy Enforces Length and Rotation
说明
A strong password policy helps protect Oracle Fusion and EPM SaaS environments against unauthorized access by enforcing minimum standards for password length, rotation, and reuse prevention for both user and administrative accounts. Enforcing password length and rotation reduces the likelihood that weak or compromised passwords are exploited to gain unauthorized access. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
检查方式
审计方法: 人工审核
For pre-upgrade environments: 1. Sign in as a Security Administrator or IT Security Manager. 2. Navigate to Tools, Security Console, Administration, Password Policy. 3. Verify that: Minimum length is ≥ 14 characters. Password expiration is ≤ 365 days. Password reuse prevention is ≥ 5 previous passwords. Account lockout triggers after ≤ 5 failed login attempts. For EPM and post-upgrade environments (OCI IAM Identity Domain): 1. In the OCI Console, go to Identity & Security, Domains, Security, Password Policy. 2. Confirm the equivalent settings: Minimum length ≥ 14.
修复方式
修复方法: 操作指南或基础设施补丁
Pre-upgrade (Security Console): 1. Navigate to Navigator Tools, Security Console, Administration, Password Policy. 2. Configure the following values: Minimum Length: 14 Require Numbers: No Require Special Characters: No Password Expiration (Days): 365 Prevent Reuse of Last Passwords: 5 Failed Sign-In Attempts Before Lockout: 5 3. Save and communicate changes to all users. EPM & Post-upgrade (OCI IAM Identity Domain): 1. In the OCI Console, open the Identity Domain Security, Password Policy. 2. Configure equivalent parameters for length, complexity, expiration, reuse prevention, and lockout. 3. Save policy updates; they take immediate effect for all users.
属性
- 操作系统
- 任意
- 标签
- oracle-saasidentity
- 参考
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.1 Ensure Password Policy Enforces Length and Rotation