Password management,
you want to establish account
management policies and procedures
for all accounts created on
information systems, and
those policies should address how
accounts are created, reviewed and
terminated.
In addition, the policy should
address who authorized the account
and what they can access.
Next, you want to perform audits of
account creation, password changes
by system administrator.
So it's essentially who watches the
watchers.
The account management process
should include creation of a triple
ticket by the Help Desk,
and then your organization could
confirm the legitimacy of the
request to reset passwords
or create accounts by correlating
the request with your Help Desk logs
next to it to find password
requirements and training on
creating strong password to think.
A lot of organizations are going to
this. But still the
most common passwords and use
right now are one two three four
five six.
If you don't have something on your
organization that prohibits users
from creating weak passwords,
you might want to
enable that on your systems and then
encourage users and instruct them on
how to create strong passwords
so they're not using
these these
very weak passwords.
That being said, though, when you
start creating too long, the
passwords are password requirements
too stringent.
One of the first things that users
are going to do is write that
password down.
So maybe single sign
on technology so they only have to
remember one password.
But again, you want to educate
that user on the creation of the
password. That one is secure,
but you don't want them to have
too difficult for the password, too
many passwords because that's
essentially going to defeat the
purpose.
And then lastly, security training
should include instruction to
block visual access to others
as users type through passcode.
So essentially putting one of those
screens on your computer
to prevent someone from seeing
what's going on.
The next is the the
principal police privilege.
So you want to carefully audit user
access permissions when employee
changes roles in the organization
to avoid privilege creep
as they move through other
organization, they may start
amassing privileges when they
move.
You simply want to reevaluate what
they need access to.
So in addition to audit
user access permissions at least
annually, that way you're ensuring
that you're removing permissions
that are no longer needed.
Then you want to establish account
management policies and procedures
just so you have something to
follow.
You want to audit account
maintenance operations regularly.
Account activity should reconcile
with helpdesk documentation
next to it to require privileged
users to have both an administrative
account with the minimum necessary
privileges to perform their duties
and a standard account for everyday
use so for their
non privileged activities.
So that while you can keep track
of the information
that they're doing, and then lastly,
review positions in the organization
that handle sensitive information or
perform critical functions,
ensure these employees cannot
perform these critical functions,
oversight and approval.
So having a two
person rule for doing
certain activities or a three
person rule for doing certain
activities helps prevent someone
from from doing things
unchecked. Within your organization,
cloud services, a lot of folks are
going to these things.
However, if you do conduct
a risk assessment of the data
services that your organization
plans to outsource to a cloud
service provider for entering into
any agreement,
your organization must ensure the
service provider possesses an
acceptable level of risk and has
implemented mitigating controls
to reduce residual risk.
So again, like we talked about
hiring an outside contractor
outside organization, you also
want to set your cloud service
provider and then verify the
cloud service providers hiring
practices to ensure it conducts a
thorough background security
investigation on any and all
personnel.
So just like we talked about, you
don't want to let the wolves into
your hen house just because
you happen to trust someone.
So everyone across the board should
have the same level
of clearance and background check
next, control or eliminate remote
administrative access to providing
cloud or virtual
services. And then lastly,
understand how the cloud service
provider protects data and other
organizational assets before
entering into an agreement.
Knowledge is power.
You don't want to enter into these
agreements and find out they're not
doing what you expect them to do to
protect your data.
So you want to verify the party
responsible for restricting logical
and physical access to your
organization's cloud assets.
Next is monitoring privileged users.
You want to conduct periodic account
reviews to avoid privilege creep
kind of touched on.
Already, when employees change
roles, the organization should
review the employee's account and
rescind permissions that the
employee no longer needs.
Especially for your larger
organizations, you
want to implement separation of
duties for all roles that affect the
production system and require at
least two people to perform any
action that may alter the system.
And the next huge multi
factor authentication for
the privilege user or system
administrator accounts.
And then a note to that requiring
multifactor authentication will
reduce the risk of the user
abusing privileged access
after administrator through
organization.
And the increased accountability of
multifactor authentication may
inhibit some currently employed
privileged users from committing
acts of malfeasance.
So the more types of security
that you can implement on the
network without completely
restricting people's ability to
work, the better off you're going
to be
reviewed change control.
So you want to periodically review
configuration baselines against the
actual production systems and
determine any discrepancies were
approved.
The changes were not approved.
You want to verify a business need
for those changes and the next
you want to implement a change
management program within the
organization.
And that process should ensure
change control work.
That's all changes to your system
networks and hardware
configurations.
You want to document those changes
in the business need.
And then the proposed changes should
be vetted by your security team
system owners, data owners and users
and other stakeholders.
And then lastly, configuration
manager must review and submit to
the Change Control Board any
software developed in-house as well
as planned changes
controlling remote access.
So disable remote access to the
organization's systems when an
employee or contractor separates
from the organization.
A lot of times this doesn't happen.
They'll terminate someone and
then you'll find out they still have
some type of ghost account out
there. They still have access to
your VPN.
So you want to be sure and disable
access to VPN service
applications and email
and then be sure to close all open
sessions as well.
Next, mobile devices
with a listening
listing of their features as a part
of the enterprise risk assessment.
So you want to
limit or identify those mobile
devices, what can and what
cannot connect to your network
and you want to prohibit or limit
personally devices.
So again, I think we've talked about
before the past lessons
by all the devices greatly
increase productivity,
but a personally owned equipment
such as laptop or a home computer
computer is permitted to access the
corporate network that should be
allowed to do so only through
an application gateway.
And this will limit what
applications are available to it.
Untrusted connection
next. You want to prohibit devices
with cameras in sensitive areas.
That's common sense, I would
hope.
Obviously, if you have proprietary
data, are you working
in a very sensitive area and you
don't want information
going outside of that area, someone
who has a camera phone or
one of those Minox cameras could
come in and start taking
photographs of your data and walking
out the door with it.
Next, you want to implement a
central management system for mobile
devices.
That way you just can control
all of the devices on your network.
And you have a central point that
does that.
And then lastly, monitor and control
remote access to the corporate
infrastructure.
So VPN tunnel should terminate
at the furthest perimeter
device and in front of an idea
Sabharwal that's going to allow for
packet inspection and network access
control.