11.4.2 For that purpose, the relevant entities shall: (a) only use system administration systems for …

Requirement

For that purpose, the relevant entities shall: (a) only use system administration systems for system administration purposes and not for any other operations; (b) separate logically such systems from application software not used for system administrative purposes, (c) protect access to system administration systems through authentication and encryption.

Guidance

• Implement strict access controls to ensure that administrative systems are used exclusively for their intended purpose. For instance, only allow authorised personnel with specific roles (e.g. system administrators and IT staff) access to system administration systems.
• Physically or logically isolate administrative systems from other application servers, for example use network segmentation to create separate zones for system administration systems and other systems, such as application servers. If applicable, physically inspect server racks to ensure separation.
• Require strong authentication mechanisms such as MFA for accessing system administration systems.
• Encrypt communication channels (e.g. secure shell protocol, hypertext transfer protocol secure) to protect data in transit to and from system administration systems.
• Encrypt sensitive configuration files and credentials stored on system administration systems.
• Ensure that application protocols are securely implemented. In addition, verify that any SSO or federation protocols are correctly implemented and conform to their specifications.

Examples of evidence

• Regularly maintained logs that track access to system administration systems.
• Network segmentation documentation indicating how system administration systems are logically or physically separated from other systems.
• Documented authentication methods used to secure access to administration systems.
• Information on encryption protocols applied to protect data transmitted to and from system administration systems.

Tips: guidance

• Consider using a centralized privileged access management (PAM) solution.
• Consider using a cloud access security broker (CASB) to enhance the visibility of, control over and the security of cloud service usage.
• Regularly audit system logs to monitor usage patterns and identify any unauthorised activities.
• Train personnel in the proper use of system administration systems.

Tips: examples of evidence

• Regularly maintained logs that track access to administration systems.
• Incident response records of any incidents related to system administration system misuse or unauthorized access.
• User training records meaning evidence that personnel have been trained in the proper use of system administration systems, for example training materials, attendance records or completion certificates.

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

3. Reglementări asociate

Tichete legate

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.