11.4.2 For that purpose, the relevant entities shall: (a) only use system administration systems for …

Requirement

For that purpose, the relevant entities shall: (a) only use system administration systems for system administration purposes and not for any other operations; (b) separate logically such systems from application software not used for system administrative purposes, (c) protect access to system administration systems through authentication and encryption.

Guidance

• Implement strict access controls to ensure that administrative systems are used exclusively for their intended purpose. For instance, only allow authorised personnel with specific roles (e.g. system administrators and IT staff) access to system administration systems.
• Physically or logically isolate administrative systems from other application servers, for example use network segmentation to create separate zones for system administration systems and other systems, such as application servers. If applicable, physically inspect server racks to ensure separation.
• Require strong authentication mechanisms such as MFA for accessing system administration systems.
• Encrypt communication channels (e.g. secure shell protocol, hypertext transfer protocol secure) to protect data in transit to and from system administration systems.
• Encrypt sensitive configuration files and credentials stored on system administration systems.
• Ensure that application protocols are securely implemented. In addition, verify that any SSO or federation protocols are correctly implemented and conform to their specifications.

Examples of evidence

• Regularly maintained logs that track access to system administration systems.
• Network segmentation documentation indicating how system administration systems are logically or physically separated from other systems.
• Documented authentication methods used to secure access to administration systems.
• Information on encryption protocols applied to protect data transmitted to and from system administration systems.

Tips: guidance

• Consider using a centralized privileged access management (PAM) solution.
• Consider using a cloud access security broker (CASB) to enhance the visibility of, control over and the security of cloud service usage.
• Regularly audit system logs to monitor usage patterns and identify any unauthorised activities.
• Train personnel in the proper use of system administration systems.

Tips: examples of evidence

• Regularly maintained logs that track access to administration systems.
• Incident response records of any incidents related to system administration system misuse or unauthorized access.
• User training records meaning evidence that personnel have been trained in the proper use of system administration systems, for example training materials, attendance records or completion certificates.

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

3. Σχετικοί κανονισμοί

Συνδεδεμένα ζητήματα

• ENISA -