Identities and credentials for authorized devices and users shall be managed.
Guidance
Identities and credentials for authorized devices and users could be managed through a password policy. A password policy is a set of rules designed to enhance ICT/OT security by encouraging organization’s to (Not limitative list and measures to be considered as appropriate):
- Change all default passwords.
- Ensure that no one works with administrator privileges for daily tasks.
- Keep a limited and updated list of system administrator accounts.
- Enforce password rules, e.g. passwords must be longer than a state-of-the-art number of characters with a combination of character types and changed periodically or when there is any suspicion of compromise.
- Use only individual accounts and never share passwords.
- Immediately disable unused accounts.
- Rights and privileges are managed by user groups.
Identities and credentials for authorized devices and users shall be managed, where feasible through automated mechanisms.
Guidance
- Automated mechanisms can help to support the management and auditing of information system credentials.
- Consider strong user authentication, meaning an authentication based on the use of at least two authentication factors from different categories of either knowledge (something only the user knows), possession (something only the user possesses) or inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way to protect the confidentiality of the authentication data.
System credentials shall be deactivated after a specified period of inactivity unless it would compromise the safe operation of (critical) processes.
Guidance
- To guarantee the safe operation, service accounts should be used for running processes and services.
- Consider the use of a formal access procedure for external parties.
For transactions within the organization's critical systems, the organization shall implement:
- multi-factor end-user authentication (MFA or "strong authentication").
- certificate-based authentication for system-to-system communications.
Guidance
Consider the use of SSO (Single Sign On) in combination with MFA for the organization's internal and external critical systems.
The organization’s critical systems shall be monitored for atypical use of system credentials. Credentials associated with significant risk shall be disabled.
Guidance
- Consider limiting the number of failed login attempts by implementing automatic lockout.
- The locked account won’t be accessible until it has been reset or the account lockout duration elapses.
Data system owner determines the access roles to the system in relation to the tasks of users. The compliance of the actual access rights with the planned ones must be monitored and the rights reassessed at regular intervals.
When reviewing access rights, care must also be taken to minimize admin rights and eliminate unnecessary accounts.
The password management system allows the user in a registration situation to decide how complex a password is to be set this time and to remember it on behalf of the user.
When using the password management system, e.g. the following principles:
Systems containing important information should be logged in using a multi-authentication logon, also known as either “two-factor”, “multi-factor” or “dual factor” authentication.
For example, when first logging in with a password, a one-time authentication code can also be sent to the user as a text message. In this case, he has been identified by two factors (knowing the password and owning the phone).
Biometric identifiers (eg fingerprint) and other devices can also be used for two-stage authentication. However, it is worth considering the costs and implications for privacy.
De-activated or expired user IDs should never be re-used for other users.
This is relevant as a general administration principle for self-developed cloud services and all other utilized data systems, where other maintenance may be provided by a partner organization, but access / user ID management by the organization itself.
The organisation must manage all of it’s users and their privileges. This includes all third party users, which have access into the organisations data or systems.
The organisation must remove users entirely or remove privileges from them when they are no longer needed e.g when employee role changes.
To protect from e.g brute force attacks the organisation must use at least one of the following practices:
In addition the following password practices should be in place:
The organisation must change the default passwords on all of its devices (e.g. computers, network devices). The changed passwords must be hard to guess.
The organization implements role-based access control with predefined access roles for the various protected assets that entitle access to the associated asset. Strictness of the access roles should reflect the security risks associated with the asset.
The following should be considered to support access management:
Shared accounts should only be allowed if they are necessary for business or operational reasons and should be separately approved and documented.
If shared accounts are used for admin purposes, passwords must be changed as soon as possible after any user with admin rights leaves their job.
The system or application login procedure should be designed to minimize the potential for unauthorized access.
The login process should therefore disclose as little information about the system or application as possible so as not to unnecessarily assist an unauthorized user. Criteria for a good login procedure include e.g.:
The automatic communication between systems should be secured with digital certificates. Digital certificates are used to identify the connecting device before granting access to the system. Secure key policy must also be taken into account here.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
