Ensure Privileged and Administrative Roles Are Restricted to Known IP Addresses

高等級 1人工審核oracle-saas

說明

When Location-Based Access Control (LBAC) is enabled in Oracle Fusion Applications, administrative and privileged roles must not be configured for unrestricted access. In the Fusion Security Console, privileged roles such as IT Security Manager and Application Implementation Consultant include the option "Enable Role ... Restricting administrative and privileged access to known IP ranges prevents unauthorized or high-risk logins from untrusted networks. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

1. Confirm that LBAC is enabled for the Fusion environment. 2. Sign in to Fusion Security Console with appropriate privileges. 3. Navigate to Roles, Search, IT Security Manager (and other privileged roles). 4. Open the role and go to the Administration tab. 5. Verify that the checkbox Enable Role for Access from All IP Addresses is not selected. 6. Confirm that privileged roles are associated with the intended network perimeter or known IP range within LBAC configuration.

修補方式

修補方法: 操作指南或基礎設施修補檔

1. Sign in to Fusion Security Console with an administrative account. 2. Navigate to Roles, Search, IT Security Manager (or equivalent privileged roles). 3. Go to the Administration tab and ensure the checkbox Enable Role for Access from All IP Addresses is cleared. 4. Verify that the role is correctly assigned to the appropriate network perimeter under LBAC settings, restricting access to known IP ranges. 5. Test access from a trusted IP and confirm the role remains functional; test from an unapproved IP to confirm access is denied.

屬性

作業系統: 不限
標籤: oracle-saasidentity
參考資料: CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 1.6 Ensure Privileged and Administrative Roles Are Restricted to Known IP Addresses