MFA enforcement may be left unconfigured or disabled for an identity, or a sign-in may be allowed to complete with a single factor. A password or token obtained through phishing, leakage or brute force is then sufficient to authenticate as that identity. This results in a loss of confidentiality of the resources the identity can read and of integrity where it can write.
Multi-Factor Authentication is Not Enforced
CCC.IAM.TH13
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP04 | Password Management | The service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements. |
| CCC.IAM.CP14 | Multi-Factor Authentication | The service may be configured to require a second authentication factor when a user signs in, and can require that MFA was used as a condition on sensitive actions. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CN13 | Enforce Multi-Factor Authentication for Human Identities | Ensure that no human identity can authenticate to the cloud environment with a single factor, so that a compromised password alone grants no access. |