Added remediation advice for insufficient_security_configurability

Author: RRudder

mappings/remediation_advice/remediation_advice.json

@@ -1027,6 +1027,10 @@
         "https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration"
       ],
       "children": [
+        {
+          "id": "insufficient_security_configurability",
+          "remediation_advice": "As a best practice, implement 2FA support. Preferably using time-based one-time passwords (TOTP) or hardware security keys (WebAuthn/FIDO2) as as a stronger option. Provide backup recovery codes during enrollment. Enforce 2FA for accounts with administrative privileges and encourage adoption across all user accounts."
+        },
         {
           "id": "lack_of_notification_email",
           "remediation_advice": "As a best practice, consider sending a notification email when questionable activity occurs, such as multiple unsuccessful login attempts."