Application credentials issued for integrations must be inventoried and reviewed

Control Statement: Every application credential the instance has issued for external software — OAuth client registrations and equivalent integration keys — must appear in an inventory recording its consumer, its scope and a named owner, and the set must be reviewed on a defined cycle.

Description: Creatio can issue credentials that let external applications authenticate without a person present: OAuth 2.0 client applications and comparable integration keys, administered in the instance’s integration settings. Each issued credential must be inventoried with the application that holds it, what it is scoped to reach, who owns it, and when it was last confirmed as still required. Credentials whose consumer is unknown or retired must be revoked.

Rationale: An issued application credential is standing access with no face: once granted, it authenticates from anywhere the secret travels — source repositories, build pipelines, a former contractor’s laptop — and it keeps working until somebody revokes it, because nothing else ever ends it. The register of issued credentials is therefore a list of doors that open from outside, and an entry nobody can explain is a door nobody is watching. Reviewing that list on a cycle is the only mechanism by which a leaked or orphaned credential stops being valid before it is used.

Audit Procedure:

1. Enumerate the application credentials the instance has issued, in the integration administration section (OAuth client applications and equivalent keys).
2. Confirm each appears in the inventory with its consuming application, scope, owner, and the date it was last reviewed.
3. Confirm the review cycle is defined and the last review falls within it.
4. Record as non-compliant any issued credential absent from the inventory, any entry whose consumer cannot be identified, and any credential unused since before the previous review.

Remediation:

1. Enumerate the issued credentials and identify each one’s consumer.
2. Revoke credentials whose consumer is unknown or retired, and observe what stops.
3. Record owner, consumer and scope for the remainder, and narrow any credential scoped beyond what its consumer requires.
4. Establish the review cycle and record the date of each pass.

Default Value: Creatio lists the application credentials it has issued but records no owner, no review date and no statement of purpose. A credential issued once remains valid until explicitly revoked.