Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff Do not create email inboxes for any administrator Do not create email inboxes for any administrator accounts (Required) accounts (Required) Administrators must have a normal user account in Administrators must have a normal user account in addition to administrator accounts. The normal account addition to administrator accounts. The normal is the only account that is allowed to use email or browse account is the only account that is allowed to use email the Internet. They should never use an administrative or browse the Internet. They should never use an account for these functions. (Required) administrative account for these functions. (Required) Implement UTM Firewall Active Directory integration with Implement UTM Firewall Active Directory integration LDAP. Alternatively the UTM Firewall could have a with LDAP. Alternatively the UTM Firewall could have a workstation client agent that passes the user name to the workstation client agent that passes the user name to firewall. In both cases the firewall would have an access the firewall. In both cases the firewall would have an control to disallow internet access to administrative access control to disallow internet access to accounts. (Required) administrative accounts. (Required) If no active directory implement a client/host based If no active directory implement a client/host based firewall with account restriction features. (Optional) firewall with account restriction features. (Optional) Control No. 12 – Controlled Use of Administrative Privilege – Quick Win No. 8 12.8 Through policy and user awareness, require that administrators establish unique, different passwords for their administrator and non-administrator accounts. Each person requiring administrative access should be given his/her own separate account. Administrative accounts should never be shared. Users should only use the Windows “administrator” or Unix “root” accounts in emergency situations. Domain administration accounts should be used when required for system administration instead of local administrator accounts. 12.8 - Recommendations: Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff Implement controls, such as dedicated administrative Implement controls, such as dedicated administrative OU’s, that have unique password requirements OU’s, that have unique password requirements Control No. 12 – Controlled Use of Administrative Privilege – Quick Win No. 9
Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff Do not create email inboxes for any administrator accounts (Required) Do not create email inboxes for any administrator accounts (Required) Administrators must have a normal user account in addition to administrator accounts. The normal account is the only account that is allowed to use email or browse the Internet. They should never use an administrative account for these functions. (Required) Administrators must have a normal user account in addition to administrator accounts. The normal account is the only account that is allowed to use email or browse the Internet. They should never use an administrative account for these functions. (Required) Implement UTM Firewall Active Directory integration with LDAP. Alternatively the UTM Firewall could have a workstation client agent that passes the user name to the firewall. In both cases the firewall would have an access control to disallow internet access to administrative accounts. (Required) Implement UTM Firewall Active Directory integration with LDAP. Alternatively the UTM Firewall could have a workstation client agent that passes the user name to the firewall. In both cases the firewall would have an access control to disallow internet access to administrative accounts. (Required) If no active directory implement a client/host based firewall with account restriction features. (Optional) If no active directory implement a client/host based firewall with account restriction features. (Optional) Control No. 12 – Controlled Use of Administrative Privilege – Quick Win No. 8 12.8 Through policy and user awareness, require that administrators establish unique, different passwords for their administrator and non-administrator accounts. Each person requiring administrative access should be given his/her own separate account. Administrative accounts should never be shared. Users should only use the Windows “administrator” or Unix “root” accounts in emergency situations. Domain administration accounts should be used when required for system administration instead of local administrator accounts. 12.8 - Recommendations: Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff Implement controls, such as dedicated administrative OU’s, that have unique password requirements Implement controls, such as dedicated administrative OU’s, that have unique password requirements Control No. 12 – Controlled Use of Administrative Privilege – Quick Win No. 9
3b-cyberrm-5-wcia-prioritizedsans20controls1.docx