Detections
Analytics

7.11 Ensure Multifactor Authentication is Required for Administrative and Other Designated Accounts

Information

Accounts designated by organizational policy, especially administrative accounts and remote interactive accounts, should use multifactor authentication. MySQL 9.x supports account definitions with up to three authentication factors.

MFA reduces the risk of credential theft, phishing, replay, and password-only compromise.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Define an authentication policy that supports the required number of factors for designated accounts. Configure those accounts to use approved multifactor authentication methods and restrict the ability to alter MFA-related policy or create passwordless accounts to authorized administrators only.

Impact:

MFA deployment may require hardware tokens, WebAuthn devices, and changes to account provisioning processes.

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), CSCv7|4.5, CSCv7|12.11

Plugin: MySQLDB

Control ID: 5d380290ddcd8fc74d92d263847c7e7a14b5fc4ecbb883293fdda3d3c2735210