Title: The DBMS, if using multifactor authentication when accessing privileged accounts via the network, must provide one of the factors by a device that is separate from the information system gaining access.
Vulnerability ID: V-32448
IA Controls: None
Description: Multifactor authentication is defined as using two or more factors to achieve authentication.
(i) Something a user knows (e.g., password/PIN);
(ii) Something a user has (e.g., cryptographic identification device, token); or
(iii) Something a user is (e.g., biometric).
A privileged account is defined as an information system account with authorizations of a privileged user.
Network access is defined as any access to an information system by a user (or process acting on behalf of a user) where said access is obtained through a network connection.
Out Of Band 2 Factor Authentication (OOB2FA) is when one of the authentication factors is provided by a device separate from the system that is used to gain access.
For example, a mobile device, such as a smart phone, is registered within the application to an application user. Upon a successful authentication, the system sends instructions to the registered mobile device in the form of on-screen prompts instructing the user on how to complete the login process.
OOB2FA employs separate communication channels where at least one is independently maintained and trusted to authenticate an end user.
Applications using multifactor authentication when accessing privileged accounts via the network must provide one of the factors by a device separate from the information system gaining access. An example of a separate device would be an RSA token.
Weak authentication can allow easy access for unauthorized users.
Check Text: Review DBMS settings to determine whether one of the factors, when using multifactor authentication of privileged accounts via the network, is separate from the information system gaining access. If one of the factors is not a device separate from the information system gaining access (i.e., an RSA token), this is a finding.
Fix Text: Configure DBMS software to require multifactor authentication, with one of the factors being a device separate from the information system gaining access, when accessing privileged accounts via the network.[divider]