Newstaff, Inc.

Business requirements for access control must be established and account for information dissemination and authorization. Business requirements include:

• access control policy
• access control rules

User access management must be in place to control allocation of access rights. Such a management process must:

• cover all stages of the user life cycle
• include the allocation of privileged access which allows override
• include a formal registration and de-registration process
• employ unique Ids
• check with the user's supervisor and the system owner
• include a written statement of access privileges
• match the level of access to the business need
• include user's agreement to the terms of access
• include formal records of access
• include processes for removing redundant accounts
• address unauthorized access
• address user privilege management
• address user password management
• include review of user access rights

User responsibilities in order to gain user co-operation is essential and must ensure:

• password confidentiality
• regular password change
• password quality
• the use of temporary password for initial login
• that passwords are not included in any automated process
• that passwords are not shared
• that single sign-on is used where multiple accesses are required
• that users ensure that unattended equipment has appropriate protection

Network access control must include:

• policy on use of networks
• enforcement of path
• authentication of external connections
• node authentication
• remote diagnostic port protection
• segregation
• network connection control
• network routing control
• a clear description of all network services

Operating system access must be controlled and should include:

• automatic terminal identification
• terminal logon procedures
• user identification and authentication
• password management
• control over the use of system utilities
• protection for users who might be the targets of coercion
• terminal time-outs
• limitations on connect time

Application access should be restricted to authorized users by:

• the application of a defined access control policy
• use of control mechanisms such as menus, restricting knowledge, controlling the transaction rights of users (read/write/delete)
• isolation of sensitive systems

System access and user should be monitored to detect deviation from policy and to record evidence and should include:

• event logging (users ID, date and time, terminal identity, successful and unsuccessful access to system and/or data
• monitoring of system for procedures and areas of risk
• assessment of risk factors
• logging and reviewing events
• clock synchronization

Mobile computing and teleworking activities cause special risks and require special protections including:

• consideration of unprotected environments
• consideration of all types of mobile devices
• consideration of special risks of teleworking

Contact Us for a proposal!