Rules and formal management process for admin rights

Critical
High
Normal
Low

Admin rights are managed through a formal process aimed at limiting the allocation of admin rights and controlling their use.

Regarding admin rights:

  • expiration requirements are defined
  • admin rights are granted only to usernames not used for normal everyday use
  • normal day-to-day use may not be performed with an admin account
Connected other frameworks and requirements:
9.2.3: Management of privileged access rights
ISO 27001
8.2: Privileged access rights
ISO 27001

Use of dedicated admin accounts in critical data systems

Critical
High
Normal
Low

Especially in the main identity management systems (e.g. Microsoft 365, Google), administrator accounts have very significant rights. These accounts are often the target of scammers and attacks because of their value. For this reason, it is useful to dedicate administrator accounts to administrative use only, and to not use these accounts for everyday use or, for example, when registering with other online services.

Connected other frameworks and requirements:
9.2.3: Management of privileged access rights
ISO 27001
8.2: Privileged access rights
ISO 27001

Using multi-factor authentication for admins

Critical
High
Normal
Low

Multi-factor authentication (MFA) is required for administrators in the organization's key data systems.

For example, when first logging in with a password, a one-time identification code can also be sent to the user as a text message. In this case, he has been identified by two factors (knowing the password and ownership of the phone).

Biometric identifiers (e.g. fingerprints) and other devices can also be used for multi-stage authentication. However, it is worth considering the costs and implications for privacy.

Connected other frameworks and requirements:
9.1.1: Access control policy
ISO 27001
9.2.3: Management of privileged access rights
ISO 27001
PR.AC-7: User, devide and other asset authentication
NIST CSF
8.2: Privileged access rights
ISO 27001
No items found.