Identity Management - Multi-Factor Authentication Coverage

Description

The percentage of user accounts secured with multi-factor authentication, a critical metric that quantifies the effectiveness of identity protection by reducing the risk of unauthorized access and safeguarding sensitive assets, making it vital for minimizing the impact of credential-based attacks.

How we measure it

Find all active Okta users and their enrolled authentication factors. Users are considered compliant if they have at least one active multi-factor authentication factor.

Meta Data

Attribute	Value
Metric id	im_authentication_mfa
Category	Identity Management
SLO	90.00% - 95.00%
Weight	0.5
Type

References

Framework	Ref	Domain	Control
CIS 8.1	6.3	Access Control Management	Require MFA for Externally-Exposed Applications
CIS 8.1	6.4	Access Control Management	Require MFA for Remote Network Access
CIS 8.1	6.5	Access Control Management	Require MFA for Administrative Access
ISO 27001:2022	A.5.17	5 Organizational controls	Authentication information
NIST CSF v2.0	PR.AA-03	Identity Management, Authentication, and Access Control (PR.AA)	PR.AA-03: Users, services, and hardware are authenticated

Code

SELECT
  users.profile_login AS resource,
  'user' AS resource_type,
  CASE WHEN count(factors.id) > 0 THEN 1 ELSE 0 END AS compliance,
  CASE
    WHEN count(factors.id) = 0 THEN 'No active MFA factor'
    ELSE 'Active MFA factors: ' || string_agg(DISTINCT factors.factor_type, ', ')
  END AS detail
FROM {{ ref('okta_users') }} AS users
LEFT JOIN {{ ref('okta_user_factors') }} AS factors
  ON factors.user_id = users.id
  AND factors.status = 'ACTIVE'
WHERE users.status = 'ACTIVE'
GROUP BY users.profile_login