TMA-ORACLE-SAAS-2.2
Ensure OCI Console Access Is Restricted to Trusted Networks
說明
Ensure that access to the Oracle Cloud Infrastructure (OCI) Console is restricted to trusted networks (secure VPNs or private network endpoints) by configuring IAM Network Sources The OCI Console provides administrative access. If user credentials are compromised, unrestricted access from any IP address increases the attack surface. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
檢查方式
稽核方法: 人工審核
此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。
1. Navigate to Identity & Security, Domains, Security, Sign-On Policies. Confirm that console login rules reference a defined network source (for example, request.networkSource.name = <TrustedSource>). Verify that there is no policy rule permitting console access from any network. 2. Navigate to Identity & Security, Network Sources. Confirm that the trusted network source contains only approved IP addresses, CIDR blocks, or VCN subnets.
修補方式
修補方法: 操作指南或基礎設施修補檔
1. Define a Network Source with trusted IP ranges or VCN subnets: Navigate to Identity & Security, Network Sources, Create Network Source. Add approved IPs or CIDRs. 2. Update the Sign-On Policy for the identity domain: Add a rule that allows console login only if request.networkSource.name matches the trusted network source. Add a default deny rule for all other networks. 3. Test access from both inside and outside the trusted network. 4. Maintain a secure break-glass account exempt from the restriction.
屬性
- 作業系統
- 不限
- 標籤
- oracle-saasnetwork
- 參考資料
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 2.2 Ensure OCI Console Access Is Restricted to Trusted Networks