2FA is not enforced in SCM

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_1
Category	IAM
Severity	HIGH

Impact

Two-factor authentication (2FA) adds an extra security layer, requiring two authentication factors in order to access the application. Even if user account credentials are compromised, an adversary will not be able to access the application only using the credentials, as they would require the second authentication factor. Currently, 2FA is not enforced for all user accounts, leaving the decision whether to enable 2FA up to the discretion of each individual user.

Recommended Solution - Buildtime

Enable the option that requires all organization members to set two-factor authentication for their user accounts.

For instructions on how to enable this option, refer to: Requiring two-factor authentication in your organization.