+IA-04(01) Prohibit Account Identifiers as Public Identifiers
|
IA-04(01) Prohibit Account Identifiers as Public Identifiers
Control
Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.
Discussion
Prohibiting account identifiers as public identifiers applies to any publicly disclosed account identifier used for communication such as, electronic mail and instant messaging. Prohibiting the use of systems account identifiers that are the same as some public identifier, such as the individual identifier section of an electronic mail address, makes it more difficult for adversaries to guess user identifiers. Prohibiting account identifiers as public identifiers without the implementation of other supporting controls only complicates guessing of identifiers. Additional protections are required for authenticators and credentials to protect the account.
Assessment Objective
the use of system account identifiers that are the same as public identifiers is prohibited for individual accounts.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing identifier management
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
system/network administrators
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|