Oracle Fusion Cloud (SaaS)
TMA-ORACLE-SAAS-1.1
Ensure Password Policy Enforces Length and Rotation
說明
A strong password policy helps protect Oracle Fusion and EPM SaaS environments against unauthorized access by enforcing minimum standards for password length, rotation, and reuse prevention for both user and administrative accounts. Enforcing password length and rotation reduces the likelihood that weak or compromised passwords are exploited to gain unauthorized access. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
檢查方式
稽核方法: 人工審核
For pre-upgrade environments: 1. Sign in as a Security Administrator or IT Security Manager. 2. Navigate to Tools, Security Console, Administration, Password Policy. 3. Verify that: Minimum length is ≥ 14 characters. Password expiration is ≤ 365 days. Password reuse prevention is ≥ 5 previous passwords. Account lockout triggers after ≤ 5 failed login attempts. For EPM and post-upgrade environments (OCI IAM Identity Domain): 1. In the OCI Console, go to Identity & Security, Domains, Security, Password Policy. 2. Confirm the equivalent settings: Minimum length ≥ 14.
修補方式
修補方法: 操作指南或基礎設施修補檔
Pre-upgrade (Security Console): 1. Navigate to Navigator Tools, Security Console, Administration, Password Policy. 2. Configure the following values: Minimum Length: 14 Require Numbers: No Require Special Characters: No Password Expiration (Days): 365 Prevent Reuse of Last Passwords: 5 Failed Sign-In Attempts Before Lockout: 5 3. Save and communicate changes to all users. EPM & Post-upgrade (OCI IAM Identity Domain): 1. In the OCI Console, open the Identity Domain Security, Password Policy. 2. Configure equivalent parameters for length, complexity, expiration, reuse prevention, and lockout. 3. Save policy updates; they take immediate effect for all users.
屬性
- 作業系統
- 不限
- 標籤
- oracle-saasidentity
- 參考資料
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.1 Ensure Password Policy Enforces Length and Rotation