Ensure Integration Account Secrets Are Rotated on a Regular Schedule

高等級 1人工審核oracle-saas

說明

Oracle SaaS environments often integrate with external systems using service accounts, OAuth clients, JWT signing keys, and X.509 certificates. These credentials are typically long-lived and, if not rotated regularly, may be compromised or reused by unauthorized parties. Long-lived credentials represent a significant risk if stolen, exposed in logs, or left unmanaged. Regular rotation reduces the risk window for credential misuse and aligns with best practices for key management. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

1. Review integration accounts in Oracle Fusion Applications and identify all OAuth clients, JWT keys, and certificates in use. 2. Confirm that each credential has a documented rotation policy, including expiration and renewal dates. 3. Validate logs or change records to confirm that credentials have been rotated within the organization's defined schedule (for example, within the past 180 days). 4. Check for expired or inactive credentials and confirm they are removed from production environments.

修補方式

修補方法: 操作指南或基礎設施修補檔

1. Develop an inventory of all integration account secrets, including OAuth credentials, JWT keys, and certificates. 2. Define a rotation schedule (for example, 90 or 180 days) aligned with organizational policy and compliance requirements. 3. Rotate each credential according to the schedule, updating dependent integrations and notifying stakeholders. 4. Remove or revoke any unused or expired credentials to reduce the attack surface. 5. Document the process and maintain records of all credential rotations for audit purposes.

屬性

作業系統: 不限
標籤: oracle-saasidentity
參考資料: CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.11 Ensure Integration Account Secrets Are Rotated on a Regular Schedule