Application accounts e.g. WebAPI Device accounts. Reference Direction Purpose Facilitate compliance with federal and state government Policies & PA-01 standards and practices e.g. Victorian Protective Data Security Standards Standards (VPDSS), Information Security Manual (ISM). Policies, standards, Consistent, secure privileged access management across and frameworks for departments based on least privilege, segregation of duties and privileged identity just-in-time control. and access Common, more secure SDLC account practices. management Managed and secured service accounts. Streamlined policy development and maintenance, once across departments. Enforced strong verification processes aligned with NeAF PA-02 Secure Enrolment identity verification standards e.g. police checks, employment Common, secure history checks, for improved assurance. online enrolment for Robust and enforced approval processes. approval and privilege for reduced risk of compromise of sensitive creation of privileged information and critical business systems. access Robust and enforced strong approval processes for improved PA-03 Secure Lifecycle assurance. Management Reduction in orphan privileged accounts for reduced risk of Common, secure compromise to sensitive information and critical business online lifecycle systems. management for Least-privilege entitlement approach for reduced risk of maintaining and compromise to sensitive information and critical business revoking privileged systems. access Allow IT administrator access without exposing administrator passwords or root-account credentials Improved security at time of use of privileged account for PA-04 Secure Access reduced risk of compromise of sensitive information and critical Control systems. Multi-factor Authentication on agreed risk profiles. authentication Expensive, complex technologies procured and invested in services and step-up once. facility for privileged Manage, control and record privileged account activities for all accounts e.g. SMS, authenticated systems across physical and virtual biometrics environments. Time restricted use of privileged access for reduced risk of Just in Time usage PA-05 compromise to sensitive information and business critical Tools for systems. enforcement of Enforced segregation of duties. use of Expensive, complex technology procured and invested in once. privileged accounts Robust tracking of privileged access use. Improved visibility of privileged access abuse to reduce risk of PA-06 Strong Assurance compromise to sensitive information and critical business Operational systems Reporting capability Low maintenance Provide assurance on privileged access Facilitate improved compliance Support audit activities Facilitate improved data quality.
Application accounts e.g. WebAPI Device accounts. Reference Direction Purpose PA-01 Policies & Standards Policies, standards, and frameworks for privileged identity and access management Facilitate compliance with federal and state government standards and practices e.g. Victorian Protective Data Security Standards (VPDSS), Information Security Manual (ISM). Consistent, secure privileged access management across departments based on least privilege, segregation of duties and just-in-time control. Common, more secure SDLC account practices. Managed and secured service accounts. Streamlined policy development and maintenance, once across departments. PA-02 Secure Enrolment Common, secure online enrolment for approval and creation of privileged access Enforced strong verification processes aligned with NeAF identity verification standards e.g. police checks, employment history checks, for improved assurance. Robust and enforced approval processes. privilege for reduced risk of compromise of sensitive information and critical business systems. PA-03 Secure Lifecycle Management Common, secure online lifecycle management for maintaining and revoking privileged access Robust and enforced strong approval processes for improved assurance. Reduction in orphan privileged accounts for reduced risk of compromise to sensitive information and critical business systems. Least-privilege entitlement approach for reduced risk of compromise to sensitive information and critical business systems. Allow IT administrator access without exposing administrator passwords or root-account credentials PA-04 Secure Access Control Multi-factor authentication services and step-up facility for privileged accounts e.g. SMS, biometrics Improved security at time of use of privileged account for reduced risk of compromise of sensitive information and critical systems. Authentication on agreed risk profiles. Expensive, complex technologies procured and invested in once. Manage, control and record privileged account activities for all authenticated systems across physical and virtual environments. PA-05 Just in Time usage Tools for enforcement of use of privileged accounts Time restricted use of privileged access for reduced risk of compromise to sensitive information and business critical systems. Enforced segregation of duties. Expensive, complex technology procured and invested in once. Robust tracking of privileged access use. PA-06 Strong Assurance Operational Reporting capability Improved visibility of privileged access abuse to reduce risk of compromise to sensitive information and critical business systems Low maintenance Provide assurance on privileged access Facilitate improved compliance Support audit activities Facilitate improved data quality.
SOD-IDAM-01-Workforce-Identity-and-Access-Management.docx