Account Management 4.4

Question 1

Least Privilege

Answer 1

Rights and permissions should be set to the bare minimum. Users should only get exactly what they need. All users accounts must be limited, apps should run with minimal privileges. Don’t allow users to run with admin privileges.

Question 2

On-Boarding (New hires or Transfers)

Answer 2

IT agreements need to be signed, and may be apart of the employee handbook or separate acceptable use policy. IT will create the accounts and associate the user with the proper groups/depts. Then provide them with the appropriate hardware for their job.

Question 3

Off-Boarding

Answer 3

You need a process for the issued hardware, the users data involving the people still working there and the people replacing this person. Many orgs only de-activate the account because you can lose critical data by deleting accounts.

Question 4

Perform Routine Audits

Answer 4

Is everyone following the policy? You have to police yourself. Make sure the audits are scheduled, they can even be automated. The logs/alerts will tell you about issues that need to be resolved.

Question 5

Auditing

Answer 5

Permissions auditing. Makes sure everyone has the correct permissions. Some admin accounts don’t actually need their admin access. Schedule recertification’s. You may also want to do a resource usage audit. Where are people storing files, are the systems in use secure? Time of day audits help you provide security. If someone is using certain machines at certain times of the day, it may be something you need to know.

Question 6

Standard Naming Convention

Answer 6

Every user needs a unique user name. Keep the same user name across multiple systems. The user name formats should be consistent. They should also not describe a role or status within the org. Their user name should never change during their employment. Memorable user names are good for users.

Question 7

Account Maintenance

Answer 7

Initial account setup, then password management, then group and permission assignments. Then force constant password updates and audit user permissions. Eventually you will disable the account, and archive user documents and encryption keys.

Question 8

Group-Based Access Control

Answer 8

Set group privileges based on what the group does. Put many users into a single group. Add/remove users from the group to give/take privileges. Users can be members of multiple groups.

Question 9

Location-Based Policies

Answer 9

User access can be based on location.