|
+Confidentiality of authentication information |
Confidentiality of authentication informationThe allocation of authentication information to access system components used to provide the cloud service to internal and external users of the cloud provider and system components that are involved in automated authorisation processes of the cloud provider is done in an orderly manner that ensures the confidentiality of the information. If passwords are used as authentication information, their confidentiality is ensured by the following procedures, as far as technically possible:• Users can initially create the password themselves or must change an initial password when logging on to the system component for the first time. An initial password loses its validity after a maximum of 14 days. • When creating passwords, compliance with the password specifications (cf. IDM-09) is enforced as far as technically possible. • The user is informed about changing or resetting the password. • The server-side storage takes place using cryptographically strong hash functions. Deviations are evaluated by means of a risk analysis and mitigating measures derived from this are implemented. Additonal CriteriaThe users sign a declaration in which they assure that they treat personal (or shared) authentication information confidentially and keep it exclusively for themselves (within the members of the group). Supplementary Information - About the CriteriaArgon2i, for example, is suitable for using a password hash function. Insofar as this is legally binding, declarations can be signed using an electronic signature. 1. Visão geral
1.1 Referências1.2 Requisitos identificados1.3 Regulamentos relacionados2. Requisitos identificados
3. Regulamentos relacionados
|