Cis Gworkspace 4.1.1.2

4.1.1.2 Ensure hardware security keys are used for all users in administrative roles and other high-value accounts

Profile Applicability

• Enterprise Level 2

Description

A hardware security key connects to a user's device using USB (A & C), Lightning, NFC, or Bluetooth connection. Also, many Android phones and Apple iPhones have built-in security keys accessible via Bluetooth and that can be assigned to a Google Workspace account.

The purpose of a physical security key is to provide an additional security layer to high value accounts; in the event of a compromise of a user's credentials (username and password) without the associated security key, the authentication process cannot be successfully completed.

Rationale

The purpose of a physical security key is to provide an additional security layer to high value accounts; in the event of a compromise of a user's credentials (username and password) without the associated security key, the authentication process cannot be successfully completed.

Hardware security keys help to protect high value accounts from targeted attacks, including phishing attempts.

Adding a hardware security key requirement to your Google privileged accounts adds another layer of depth of protection greater than any other form of two-factor authentication.

Impact

Users with hardware security keys enabled will need to have physical access to the hardware key in order complete the authentication process and this will force users to adopt a practice of making sure that the physical key is available to them at any point in time that they need to be able to log in.

If a hardware security key is lost or stolen, the impacted user can gain access to their Google account by using a backup MFA process and then remove the lost/stolen key and add another one.

If a hardware security key is stolen, the user's account is not automatically compromised as the hardware key works in conjunction with the user's account credentials (username & password).

Audit

To verify this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Go to Security and click on Authentication
3. Under Authentication, select 2-Step Verification
4. Ensure the option to Allow users to turn on 2-Step Verification is checked
5. Ensure that the Enforcement option is set to either 'On' or 'On from' with a valid date present
6. Under Methods ensure that Only security key is selected
7. Under 2-Step Verification policy suspension grace period ensure that 1 day is selected
8. Under Security codes ensure that Don't allow users to generate security codes is selected

Remediation

To configure this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Go to Security and click on Authentication
3. Under Authentication, select 2-Step Verification
4. Select the option to Allow users to turn on 2-Step Verification
5. Under Enforcement, enable either 'On' or else 'On from' and configure a valid date
6. Under Methods, select Only security key to force the use of a security key
7. Under 2-Step Verification policy suspension grace period, select 1 day
8. Under Security codes, select Don't allow users to generate security codes
9. Select Save

Default Value

• Allow users to turn on 2-Step Verification is checked
• Enforcement is Off
• New user enrollment period is None
• Frequency - Allow user to trust device is checked
• Methods is Any

References

1. https://support.google.com/accounts/answer/6103523?hl=En

CIS Controls