Cyber Defense eMagazine January Edition for 2022

1. Develop requirements for an Access Control Program. A formal Access Control Program
should be implemented that includes a documented user registration and de-registration process
for requesting, approving, granting, modifying, reviewing, or revoking access. Access control rules
should reflect the requirements of your organization for the authorization, access to,
dissemination, and viewing of information. These rules should be supported by formal procedures
with clearly defined responsibilities that are assigned to appropriate roles. Be sure your access
control requirements address both logical and physical control measures which should both be
based upon the principle of least-privilege.
2. Identify and document account types. Account types (e.g., standard user, privileged user,
system, service, etc.) used by your organization should be identified and documented. Access
control rules for each user, or group of users, should be clearly stated. The conditions for group
or role membership should be established as well. Users should have a clear understanding of
the security requirements to be met by the access controls implemented by your organization.
3. Ensure ongoing account management is in place. Unauthorized or inappropriate account
access is likely to occur if ongoing maintenance is not in place for all accounts. Account
management is not a “one-and-done” exercise but must be performed on a recurring basis to
maintain effectiveness. Management approval should be required for all requests to create
accounts. Accounts should be created, enabled, modified, monitored, disabled, and removed in
accordance with an approved Access Control Policy. Supporting procedures should detail the
steps required to meet the defined policy control requirements. Periodic internal account and
access reviews or audits should be performed, at least annually, during which the privileges
should be verified to validate that the need for currently assigned privileges still exists.
4. Actions need to be associated with a unique, individual user. All users should be assigned a
unique identifier (user ID) for their personal use only. Appropriate user authentication techniques
should also be implemented to substantiate the claimed identity of any authorized user requesting
access each time they log in to your organization’s networks, systems, or applications. Baseline
controls should include settings for password or passphrase composition and complexity
requirements.
5. Set controls for accounts with privileged access. This is needed to reduce the likelihood of
providing standard users with more access permissions than they require. Appropriate checks or
validations for actions performed with privileged accounts should also be implemented to ensure
authorized privileged account users are fulfilling their assigned roles in accordance with
prescribed security control requirements. The principle of least privilege must be followed,
authorizing only access that is necessary for each individual user to accomplish their assigned
tasks in accordance with your organization’s mission or business functions.
6. Implement and maintain secure logon processes. This verifies the identity of users and
associates the user with the actions they perform. Secure logon processes may also help reduce
the likelihood of password compromise that may lead to security incidents or data breaches. A
limit of five (or less) consecutive invalid logon attempts by a user during a fifteen-minute period
should be implemented. Accounts should be locked after this threshold of failed logon attempts
is reached. It is encouraged to send failed logon alerts, along with other appropriate domain
controller alerts, to personnel responsible for monitoring the networks of your organization.
7. Provide for password management. This serves as one line of defense for protecting
organizations, along with customer information they manage, from unauthorized access due to
Cyber Defense eMagazine – January 2022 Edition 114
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.