11.3.2 The policies referred to in point 11.3.1. shall: (a) establish strong identification …

Requirement

The policies referred to in point 11.3.1. shall: (a) establish strong identification, authentication such as multi-factor authentication and authorisation procedures for privileged accounts and system administration accounts; (b) set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance; (c) individualise and restrict system administration privileges to the highest extent possible, (d) provide that system administration accounts are only used to connect to system administration systems.

Guidance

• Introduce higher authentication requirements for privileged access rights, such as re-authentication or authentication step-up before using privileged access rights.
• Define and implement expiry requirements for privileged access rights, where appropriate.
• In the absence of a system that allows all uses to be attributed to an individual with certainty, establish specific rules to avoid the use of generic administration user IDs (e.g. ‘root’) and manage and protect the authentication information of such identities.
• Grant temporary privileged access only for the time necessary to implement approved changes or activities (e.g. for maintenance activities), rather than permanently granting privileged access rights.
  • Consider the frequency of system administration operations : daily tasks (e.g. backups and email routing) versus weekly or monthly tasks (e.g. reviewing memory and disk space).
• Log all privileged access for audit purposes;
• Assign separate identities with privileged access rights to individual users, rather than sharing or linking identities. Group identities for easier management if needed.
• Use identities with privileged access rights exclusively for administrative tasks, not for day-to-day general tasks such as checking email or accessing the web. Where feasible (92) , separate privileged identities should be assigned for administrative tasks.
• Ensure users are aware of their privileged access rights or when they are in privileged access mode, for example using specific user identities, user interface settings or equipment.

Examples of evidence

• Measures for privileged access control and monitoring for privileged accounts, including granting and revoking privileged access rights.
• Access assignment records showing how access rights are initially granted, based on job roles and responsibilities.
• Clear definitions of user roles and the corresponding access rights associated with each role.
• Audit trail and monitoring logs that capture the use of access rights, including any unauthorized access attempts and actions taken in response.

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

3. Regulamentos relacionados

Pedidos ligados

• ENISA -