Description

Ensure every member of the Render workspace has turned on two-factor authentication (2FA) for their Render account. With 2FA, signing in requires a one-time code in addition to the password, so a stolen password alone is not enough to access the workspace.

Rationale

Render accounts can deploy code, read environment variables and secrets, open shells on running services, and delete databases. If a member's password is phished or reused from another breach, an attacker could take over the account and the workspace resources it can reach. 2FA blocks most of these account takeovers.

Impact

  • Stolen passwords alone cannot be used to sign in

  • Protects deploy access, secrets, and databases

  • Each member must set up an authenticator app

Default Value

By default, 2FA is turned off for each Render account and is enabled by each user from their own Account Settings.

Pre-Requisites

  • Workspace Admin role to review members

  • Each member's cooperation to enable 2FA on their own account

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Check whether two-factor authentication is enforced for the workspace. If it is, every member who can access the workspace has 2FA enabled.

  4. If 2FA is not enforced, ask each member listed in the Team members section to confirm in Account Settings > Account Security that two-factor authentication is on.

  5. If any member does not have 2FA enabled, follow the implementation steps.

Implementation Steps

  1. Ask each member without 2FA to sign in to the Render Dashboard.

  2. The member opens Account Settings (dashboard.render.com/u/settings) and goes to the Account Security section.

  3. The member toggles on two-factor authentication and completes setup with an authenticator app.

  4. To make this mandatory for everyone, also enforce 2FA for the workspace (see the next check).

Backout Plan

  1. A member can turn off two-factor authentication from Account Settings > Account Security. Note that this will block them from the workspace if 2FA is enforced.

Reference