Detections
Analytics
7.1 Ensure your 'authentication_policy' is Set to a Secure Option
Information
Define your authentication policy by setting the MySQL system variable authentication_policy.MySQL 9.x supports up to three authentication factors per account definition. Use authentication_policy to constrain which authentication methods are permitted for each factor and to align designated accounts with the organization's MFA requirements. Where phishing-resistant authentication is required, include WebAuthn as an approved factor.
Avoid deprecated or unapproved methods such as mysql_native_password, and review any passwordless WebAuthn use carefully because creation of such accounts should be limited to approved use cases and authorized administrators only.
Caching SHA-2 authentication remains the default password-based method, but MySQL 9.x authentication policy should be defined explicitly rather than relying only on defaults.
A defined authentication policy reduces the risk of weak or inconsistent account authentication. Constraining allowed factors and plugins helps prevent use of deprecated or lower-assurance methods and supports MFA for designated accounts.
Solution
Assess the value of authentication_policy and set it to the organization's approved factor and plugin pattern.If users still rely on deprecated or nonapproved methods, migrate them to an approved method such as caching_sha2_password or another approved enterprise authentication mechanism.
Example assessment:
SHOW VARIABLES WHERE Variable_name = 'authentication_policy';
SELECT host, user, plugin FROM mysql.user;
If WebAuthn is required for designated accounts, configure those accounts accordingly and restrict passwordless-account creation and authentication-policy changes to authorized administrators only.
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-2(1), CSCv7|16.4
Plugin: MySQLDB
Control ID: 5a72bc5c8eb915ceba0ad6fc7818b7b7856f469f1a16c0c8f68020592c4705a0