DOS4240

Organization Member - Should have two-factor authentication enabled

DOS4240

GitHub organization Severitycritical builtIn

Description

Every organization member should have two-factor authentication enabled. The TwoFactorDisabled property is true ONLY when GitHub explicitly reports the member appears in the ?filter=2fa_disabled audit; null or false means 2FA is enabled. Members with 2FA disabled are a common attack vector for org takeover and should be required to enroll before accessing sensitive resources.

En savoir plus

Recommandation

1. Go to Organization Settings -> Authentication security. 
2. Enable 'Require two-factor authentication for everyone in this organization'. 
3. Reach out to non-compliant members; they will be removed from the org if they do not enroll within the GitHub-mandated grace period.

Règle de politique

{
  "target": "GHOrganizationMember",
  "if": {
    "allOf": [
      {
        "resource": "GHOrganizationMember",
        "property": "TwoFactorDisabled",
        "operator": "notEquals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS4230 DOS4245 »
Détails de la règle
  • ID de la règle: DOS4240
  • Code: GH_Organization_Member_Should_Have_2FA_Enabled
  • Plateforme: GitHub
  • Catégorie: organization
  • Sévérité: Severitycritical
  • Type: builtIn
Règles connexes

Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation | v1.0.2