+KSI-IAM Identity and Access Management
---+KSI-IAM-AAM Automating Account Management
---+KSI-IAM-APM Adopting Passwordless Methods
---+KSI-IAM-ELP Ensuring Least Privilege
---+KSI-IAM-JIT Authorizing Just-in-Time
---+KSI-IAM-SNU Securing Non-User Authentication
---+KSI-IAM-SUS Responding to Suspicious Activity
|
KSI-IAM Identity and Access Management
1. Översikt
| Rubrik |
Standard |
|
KSI-IAM-AAM Automating Account Management
|
The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. NIST SP 800-53 Rev. 5 controls: AC-2(13), AC-2(2), AC-2(3), AC-6(7), IA-12, IA-12(2), IA-12(3), IA-12(5), IA-4(4), IA-8(4)
|
|
KSI-IAM-APM Adopting Passwordless Methods
|
Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. NIST SP 800-53 Rev. 5 controls: AC-2, AC-3, IA-2, IA-2(1), IA-2(2), IA-2(6), IA-2(8), IA-5, IA-5(1), IA-5(2), IA-5(6), IA-5(8), IA-6, IA-8, IA-8(2), IA-8(4), SC-23
|
|
KSI-IAM-ELP Ensuring Least Privilege
|
Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. NIST SP 800-53 Rev. 5 controls: AC-12, AC-14, AC-17, AC-17(1), AC-17(2), AC-17(3), AC-18(4), AC-2(11), AC-2(5), AC-2(6), AC-2(7), AC-2(9), AC-20, AC-20(1), AC-21, AC-3, AC-4, AC-6, AC-6(3), AC-6(8), AU-12(3), AU-6(7), CM-2(7), CM-5(1), CM-5(5), CM-7(2), CM-9, IA-11, IA-2, IA-3, IA-4, IA-4(4), IA-5(2), IA-5(6), IR-4(6), IR-9(4), PS-2, PS-3, PS-4, PS-5, PS-6, RA-5(5), SC-2, SC-20, SC-21, SC-22, SC-23, SC-3, SC-39, SC-4, SI-3, SI-4(19) Defined terms: Persistently
|
|
KSI-IAM-JIT Authorizing Just-in-Time
|
A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. NIST SP 800-53 Rev. 5 controls: AC-17, AC-17(4), AC-2, AC-2(1), AC-2(11), AC-2(2), AC-2(3), AC-2(4), AC-2(6), AC-2(7), AC-20(1), AC-21, AC-3, AC-4, AC-5, AC-6, AC-6(1), AC-6(10), AC-6(2), AC-6(3), AC-6(5), AC-6(7), AC-6(8), AC-6(9), AC-7, AU-10, AU-12(3), AU-9(4), CA-3(6), CM-5, CM-5(1), CM-5(5), CM-7, CM-7(2), CM-7(5), CM-9, IA-4, IA-4(4), IA-7, IR-4(6), PS-2, PS-3, PS-4, PS-5, PS-6, PS-9, RA-5(5), SC-2, SC-23, SC-3, SC-39 Defined terms: Persistently
|
|
KSI-IAM-SNU Securing Non-User Authentication
|
Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. NIST SP 800-53 Rev. 5 controls: AC-2, AC-2(2), AC-2(9), AC-4, AC-6(5), AU-10, IA-2(5), IA-3, IA-5(2), RA-5(5) Defined terms: Persistently
|
|
KSI-IAM-SUS Responding to Suspicious Activity
|
Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. NIST SP 800-53 Rev. 5 controls: AC-2, AC-2(1), AC-2(11), AC-2(12), AC-2(13), AC-2(3), AC-7, AU-6(5), CM-5(1), CM-6(2), IR-4(2), IR-4(6), PS-4, PS-8, SI-4, SI-4(1), SI-4(19), SI-4(20), SI-4(22), SI-4(4) Defined terms: Vulnerability Response
|
1.1 Referenser
1.2 Identifierade krav
1.3 Relaterade regleringar
2. Identifierade krav
3. Relaterade regleringar
Regleringar
| Källa |
Reglering |
- FedRAMP Consolidated Rules -
EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.
DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.
|