+AC-02(07) Privileged User Accounts
|
AC-02(07) Privileged User Accounts
Control
- Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme];
- Monitor privileged role or attribute assignments;
- Monitor changes to roles or attributes; and
- Revoke access when privileged role or attribute assignments are no longer appropriate.
Discussion
Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. Privileged roles include key management, account management, database administration, system and network administration, and web administration. A role-based access scheme organizes permitted system access and privileges into roles. In contrast, an attribute-based access scheme specifies allowed system access and privileges based on attributes.
Assessment Objective
- privileged user accounts are established and administered in accordance with [Selection: a role-based access scheme; an attribute-based access scheme];
- privileged role or attribute assignments are monitored;
- changes to roles or attributes are monitored;
- access is revoked when privileged role or attribute assignments are no longer appropriate.
Assessment Method
Examine
Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of privileged user accounts and associated roles
records of actions taken when privileged role assignments are no longer appropriate
system audit records
audit tracking and monitoring reports
system monitoring records
system security plan
other relevant documents or records
Interview
Organizational personnel with account management responsibilities
system/network administrators
organizational personnel with information security responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|