Oracle WebLogic must be integrated with a tool to implement multi-factor user authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-56387	WBLC-10-000272	SV-70641r1_rule		Medium

Description
Multifactor authentication is defined as: using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A CAC meets this definition. Implementing a tool, such as Oracle Access Manager, will implement multi-factor authentication to the application server and tie the authenticated user to a user account (i.e. roles and privileges) assigned to the authenticated user.

Description

Multifactor authentication is defined as: using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A CAC meets this definition. Implementing a tool, such as Oracle Access Manager, will implement multi-factor authentication to the application server and tie the authenticated user to a user account (i.e. roles and privileges) assigned to the authenticated user.

STIG	Date
Oracle WebLogic Server 12c Security Technical Implementation Guide	2016-02-03

Details

Check Text ( C-56941r1_chk )
Review the WebLogic configuration to determine if a tool, such as Oracle Access Manager, is in place to implement multi-factor authentication for the users. If a tool is not in place to implement multi-factor authentication, this is a finding.

Fix Text (F-61265r1_fix)
Install a tool, such as Oracle Access Manager, to handle multi-factor authentication of users.