Detections
Analytics

7.12 Ensure WebAuthn is Used for Phishing-Resistant Authentication Where Required

Information

Where phishing-resistant authentication is required, configure MySQL Enterprise Edition to use WebAuthn for the appropriate factor. For MySQL 9.x, WebAuthn replaces older FIDO-focused wording and supports modern FIDO/FIDO2 authenticators.

WebAuthn provides stronger resistance to phishing and credential replay than password-only authentication.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Install and configure the MySQL Enterprise WebAuthn authentication support where required. Assign WebAuthn as an approved factor for designated accounts and review any passwordless deployments carefully before approval.

Impact:

WebAuthn deployment may require compatible devices, browser or client support, and enrollment procedures.

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), 800-53|IA-2(2), CSCv7|12.11

Plugin: MySQLDB

Control ID: dd524956b83e9e304ded3d2749a580f62eedb1014021492526ae5f41c8e91201