and data in the data centre? How are privileged Various of the APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology system deal with privileged system administration accounts. For example, it lists or other privileged access to sensitive “administration administration or critical IT assets” as one of several where increased authentication strength is typically required, given the risks “examples accounts managed? involved”. Describe the procedures Access to the IT systems that customer data is strictly controlled via role-based access control (RBAC) and lock box governing the processes. Access control is an automated process that follows the separation of duties principle and the principle of granting issuance (including least privilege. This process ensures that the engineer requesting access to these IT systems has met the eligibility emergency protection, requirements, such as a background screen, fingerprinting, required security training, and access approvals. In addition, the maintenance and access levels are reviewed on a periodic basis to ensure that only users who have appropriate business justification have destruction of these access to the systems. User access to data is also limited by user role. For example, system administrators are not provided accounts. Please with database administrative access. describe how the privileged accounts In emergency situations, a (as defined access and elevation system” is used (that is, elevation is granted on an “JIT are subjected to dual and only-at-the-time-of-need basis) of engineer privileges to troubleshoot the service. control (e.g. password is split into 2 halves and each given to a different staff for custody). Are the activities of APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology states that “a privileged accounts regulated institution would typically deploy… [audit logging and monitoring of access to IT assets by all users] to limit access to captured (e.g. IT assets, based on a risk assessment”. system audit logs) and reviewed
and data in the data centre? How are privileged system administration accounts managed? Describe the procedures governing the issuance (including emergency protection, maintenance and destruction of these accounts. Please describe how the privileged accounts are subjected to dual control (e.g. password is split into 2 halves and each given to a different staff for custody). Various of the APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology deal with privileged system administration accounts. For example, it lists “administration or other privileged access to sensitive or critical IT assets” as one of several “examples where increased authentication strength is typically required, given the risks involved”. Access to the IT systems that customer data is strictly controlled via role-based access control (RBAC) and lock box processes. Access control is an automated process that follows the separation of duties principle and the principle of granting least privilege. This process ensures that the engineer requesting access to these IT systems has met the eligibility requirements, such as a background screen, fingerprinting, required security training, and access approvals. In addition, the access levels are reviewed on a periodic basis to ensure that only users who have appropriate business justification have access to the systems. User access to data is also limited by user role. For example, system administrators are not provided with database administrative access. In emergency situations, a “JIT (as defined access and elevation system” is used (that is, elevation is granted on an and only-at-the-time-of-need basis) of engineer privileges to troubleshoot the service. Are the activities of privileged accounts captured (e.g. system audit logs) and reviewed APRA Prudential Practice Guide: Management of Security Risk in Information and Information Technology states that “a regulated institution would typically deploy… [audit logging and monitoring of access to IT assets by all users] to limit access to IT assets, based on a risk assessment”.