TMA-ORACLE-SAAS-1.3

Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts

高级别 1人工审核oracle-saas

说明

Multi-Factor Authentication (MFA) requires users to present an additional verification factor beyond username and password. In Oracle Fusion environments, native MFA enforcement via Identity Domain sign-on policies functions only after the environment's identity service is upgraded to OCI IAM or an external IdP. Privileged accounts are high-value targets. Enforcing MFA with phishing resistant factors reduces the risk of unauthorized administrative access even if credentials are compromised. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

1. Determine if the Fusion environment has been upgraded to use OCI IAM (check Fusion environment's maintenance/upgrade status) or is using an external IdP for MFA. 2. Access the Security Console User Categories Two-Factor Authentication and confirm SaaS administrators/privileged categories have MFA enabled. Only enable factors that are considered phishing resistant. 3. If identity upgrade has not occurred, verify that MFA is enforced via the external IdP for privileged accounts. 4. Test login with a privileged account and confirm MFA prompt is required (native or via IdP).

修复方式

修复方法: 操作指南或基础设施补丁

1. If identity upgrade is not finalized implement MFA via the external IdP. 2. After the upgrade, in the Security Console open User Categories Two-Factor Authentication and enable MFA for administrator/privileged categories. 3. Define valid phishing resistant MFA factors (mobile authenticator, FIDO, etc.). 4. Save settings and ensure SaaS users enroll in MFA during their next login. 5. Test that privileged accounts require MFA (OCI IAM) and fallback to IdP enrollment where needed.

属性

操作系统: 任意
标签: oracle-saasidentity
参考: CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.3 Ensure Phishing-Resistant MFA Is Enforced for SaaS Administrators and Privileged Accounts