cyberstrikeus 1.2 Ensure That Multi-Factor Authentication is Enabled for All Non-Service Accounts (Manual)
Profile Applicability
- Level 1
Description
Setup multi-factor authentication for Google Cloud Platform accounts.
Rationale
Multi-factor authentication requires more than one mechanism to authenticate a user. This secures user logins from attackers exploiting stolen or weak credentials.
Impact
None documented.
Audit Procedure
From Google Cloud Console
For each Google Cloud Platform project, folder, or organization:
- Identify non-service accounts.
- Manually verify that multi-factor authentication for each account is set.
Expected Result
All non-service accounts should have multi-factor authentication enabled.
Remediation
From Google Cloud Console
For each Google Cloud Platform project:
- Identify non-service accounts.
- Setup multi-factor authentication for each account.
Default Value
By default, multi-factor authentication is not set.
References
- https://cloud.google.com/solutions/securing-gcp-account-u2f
- https://support.google.com/accounts/answer/185839
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.3 Require MFA for Externally-Exposed Applications - Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard. | x | x | |
| v7 | 16.3 Require Multi-factor Authentication - Require multi-factor authentication for all user accounts, on all systems, whether managed onsite or by a third-party provider. | x | x |