+AC-09 Previous Logon Notification
---+AC-09(01) Unsuccessful Logons
---+AC-09(02) Successful and Unsuccessful Logons
---+AC-09(03) Notification of Account Changes
---+AC-09(04) Additional Logon Information
|
AC-09 Previous Logon Notification
Control
Notify the user, upon successful logon to the system, of the date and time of the last logon.
Discussion
Previous logon notification is applicable to system access via human user interfaces and access to systems that occurs in other types of architectures. Information about the last successful logon allows the user to recognize if the date and time provided is not consistent with the user’s last access.
Assessment Objective
the user is notified, upon successful logon to the system, of the date and time of the last logon.
Assessment Method
Examine
Access control policy
procedures addressing previous logon notification
system design documentation
system configuration settings and associated documentation
system notification messages
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developers
1. Επισκόπηση
| Τίτλος |
Πρότυπο |
|
AC-09(01) Unsuccessful Logons
|
Control
Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
Discussion
Information about the number of unsuccessful logon attempts since the last successful logon allows the user to recognize if the number of unsuccessful logon attempts is consistent with the user’s actual logon attempts.
Assessment Objective
the user is notified, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
Assessment Method
Examine
Access control policy
procedures addressing previous logon notification
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developers
|
|
AC-09(02) Successful and Unsuccessful Logons
|
Control
Notify the user, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignement: time period].
Discussion
Information about the number of successful and unsuccessful logon attempts within a specified time period allows the user to recognize if the number and type of logon attempts are consistent with the user’s actual logon attempts.
Assessment Objective
the user is notified, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignement: time period].
Assessment Method
Examine
Access control policy
procedures addressing previous logon notification
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developers
|
|
AC-09(03) Notification of Account Changes
|
Control
Notify the user, upon successful logon, of changes to [Assignement: security-related characteristics or parameters] during [Assignement: time period].
Discussion
Information about changes to security-related account characteristics within a specified time period allows users to recognize if changes were made without their knowledge.
Assessment Objective
the user is notified, upon successful logon, of changes to [Assignement: security-related characteristics or parameters] during [Assignement: time period].
Assessment Method
Examine
Access control policy
procedures addressing previous logon notification
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developers
|
|
AC-09(04) Additional Logon Information
|
Control
Notify the user, upon successful logon, of the following additional information: [Assignement: additional information].
Discussion
Organizations can specify additional information to be provided to users upon logon, including the location of the last logon. User location is defined as information that can be determined by systems, such as Internet Protocol (IP) addresses from which network logons occurred, notifications of local logons, or device identifiers.
Assessment Objective
the user is notified, upon successful logon, of [Assignement: additional information].
Assessment Method
Examine
Access control policy
procedures addressing previous logon notification
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developers
|
1.1 Παραπομπές
1.2 Εντοπισμένες απαιτήσεις
1.3 Σχετικοί κανονισμοί
2. Εντοπισμένες απαιτήσεις
3. Σχετικοί κανονισμοί
Κανονισμοί
| Πηγή |
Κανονισμός |
Συνδεδεμένα ζητήματα
|