+APP.2.2.A7 Implementation of Secure Administration Methods for Active Directory [Process Owner] (B)

APP.2.2.A7 Implementation of Secure Administration Methods for Active Directory [Process Owner] (B)

It MUST be possible to clearly trace every account to an employee.

The number of service administrators and data administrators for Active Directory MUST be limited to the required minimum of trustworthy persons.

The default “Administrator”" account SHOULD be renamed. An “Administrator” account without privileges SHOULD be created.

It MUST be ensured that the administration of service administrator accounts is only performed by members of the Service Administrator group. The “Account Operators” group SHOULD be empty.

Administrators SHOULD only be assigned to the “Scheme Administrators” group temporarily for the time required to change the scheme. For the groups “Organisational Administrators” and “Domain Administrators”, the dual-control principle SHOULD be established for administration of the root domain.

It MUST be ensured that the “Administrators” and “Domain Administrators” groups are also owners of the domain root object of the domain in question.

The use of domain-local groups for controlling the read privileges of object attributes SHOULD be avoided.

The recycle bin of AD SHOULD be enabled.

In large organisations, an enterprise identity management solution SHOULD be used in order to ensure that the rights of all users comply with the defined specifications.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.11 Failure or Disruption of Service Providers
blocks G 0.14 Interception of Information / Espionage
blocks G 0.15 Eavesdropping
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.36 Identity theft
blocks G 0.38 Misuse of Personal Information
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.46 Loss of Integrity of Sensitive Information