Objective: Access to information and IT systems is provided via validated user accounts assigned to a person. It is important to protect login information and to ensure the traceability of transactions and accesses.
Requirements (must): The creating, changing, and deleting of user accounts is conducted.
Unique and personalized user accounts are used.
The use of “collective accounts” is regulated (e.g. restricted to cases where traceability of actions is dispensable).
User accounts are disabled immediately after the user has resigned from or left the organization (e.g. upon termination of the employment contract).
User accounts are regularly reviewed.
The login information is provided to the user in a secure manner.
A policy for the handling of login information is defined and implemented. The following aspects are considered:
- No disclosure of login information to third parties
- not even to persons of authority
- under observation of legal parameters
- No writing down or unencrypted storing of login information
- Immediate changing of login information whenever potential compromising is suspected
- No use of identical login information for business and non-business purposes
- Changing of temporary or initial login information following the 1st login - Requirements for the quality of authentication information (e.g. length of password, types of characters to be used).
The login information (e.g. passwords) of a personalized user account must be known to the assigned user only.
Requirements (should): A basic user account with minimum access rights and functionalities is existent and used.
Default accounts and passwords pre-configured by manufacturers are disabled (e.g. by blocking or changing of password).
User accounts are created or authorized by the responsible body.
Creating user accounts is subject to an approval process (four-eyes principle).
User accounts of service providers are disabled upon completion of their task.
Deadlines for disabling and deleting user accounts are defined.
The use of default passwords is technically prevented.
Where strong authentication is applied, the use of the medium (e.g. ownership factor) is secure.
User accounts are reviewed at regular intervals. This also includes user accounts in customers' IT systems.
Interactive login for service accounts (technical accounts) is technically prevented.
Data system owner determines the access roles to the system in relation to the tasks of users. The compliance of the actual access rights with the planned ones must be monitored and the rights reassessed at regular intervals.
When reviewing access rights, care must also be taken to minimize admin rights and eliminate unnecessary accounts.
The organisation must manage all of it’s users and their privileges. This includes all third party users, which have access into the organisations data or systems.
The organisation must remove users entirely or remove privileges from them when they are no longer needed e.g when employee role changes.
The organization implements role-based access control with predefined access roles for the various protected assets that entitle access to the associated asset. Strictness of the access roles should reflect the security risks associated with the asset.
The following should be considered to support access management:
Especially in the main identity management systems (e.g. Microsoft 365, Google), administrator accounts have very significant rights. These accounts are often the target of scammers and attacks because of their value. For this reason, it is useful to dedicate administrator accounts to administrative use only, and to not use these accounts for everyday use or, for example, when registering with other online services.
In all changes on employment relationship, access rights should be reviewed in cooperation with the owners of the protected property and re-granted to the person completely when there is a significant change in the person's employment. A change can be a promotion or a change of role (e.g., moving from one unit to another).
The need-to-know principle grants access only to information that an individual needs to perform his or her task. Different tasks and roles have different information needs and thus different access profiles.
Separation of tasks means that conflicting tasks and responsibilities must be separated in order to reduce the risk of unauthorized or unintentional modification or misuse of the organisation's protected assets.
The granting of access rights in the organisation related to high confidentiality access can only be approved by the internal owner of the related high confidentiality information.
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
