Control S141.3 under ISMF Standard 141 specifies that Responsible Parties should establish procedures for the granting and revocation of administrative privileges while discouraging their use unless explicitly required, according to the following best practice guidance: Applicability Guidance References Business Owners should integrate Endpoint device access privilege ISMF Standard 76 management into the Agency’s information access policy (refer ISMF Standard 76 Access control policy). Responsible Parties should maintain and regularly review the security ISMF Standard 77 mechanisms for granting and revoking end-point device privileges. Responsible Parties should strictly assign end-point access privileges ISMF Standard 78 based on a user’s functions and role, and to restrict access to information assets they need to carry out their job. Responsible Parties must not temporarily assign excessive privileges ISMF Standard 78 (e.g. administrative privileges) to end-point device users, even All classifications temporarily. When users need to perform privileged tasks, the permission must be limited to the specific tasks. If this is not practical, authorised administrators should perform the tasks. Consideration should be given to implementing products to define and manage access to administrator accounts (e.g. as…”). This “Sudo”, “Run removes the need to share broad administrative privileges between those requiring that level of access, as well as allowing access to be defined only to the specific functions required in order to meet job responsibilities. Responsible Parties should prescribe suitable procedures and ISMF Standard 94 authentication techniques that prevent privilege sharing, such as shared Endpoint device logins. Responsible Parties should log all privileged account allocations, ISMF Standard 80 changes and activity for regular reviews. Responsible Parties should review privileged allocations and ISMF Standard 77 changes when significant employment changes occur, but at least [I3] Integrity 3 every three months. Business Owners should authorise privileged Endpoint access (e.g. ISMF Standard 80 administrative privileges), and undertake a comprehensive review relative to general user access rights at least quarterly. INACTIVITY MEASURES FOR UNATTENDED DEVICES Devices may be to being operational but unattended for extended periods (e.g. user(s) remain loggedin with applications running). This provides easy access to the Endpoint device, its information and the environment it is connected to. Inactivity measures can reduce this risk. They limit how long an Endpoint can be unattended or inactive.
Control S141.3 under ISMF Standard 141 specifies that Responsible Parties should establish procedures for the granting and revocation of administrative privileges while discouraging their use unless explicitly required, according to the following best practice guidance: Applicability Guidance References All classifications Business Owners should integrate Endpoint device access privilege management into the Agency’s information access policy (refer ISMF Standard 76 Access control policy). ISMF Standard 76 Responsible Parties should maintain and regularly review the security mechanisms for granting and revoking end-point device privileges. ISMF Standard 77 Responsible Parties should strictly assign end-point access privileges based on a user’s functions and role, and to restrict access to information assets they need to carry out their job. ISMF Standard 78 Responsible Parties must not temporarily assign excessive privileges (e.g. administrative privileges) to end-point device users, even temporarily. When users need to perform privileged tasks, the permission must be limited to the specific tasks. If this is not practical, authorised administrators should perform the tasks. Consideration should be given to implementing products to define and manage access to administrator accounts (e.g. “Sudo”, “Run as…”). This removes the need to share broad administrative privileges between those requiring that level of access, as well as allowing access to be defined only to the specific functions required in order to meet job responsibilities. ISMF Standard 78 Responsible Parties should prescribe suitable procedures and authentication techniques that prevent privilege sharing, such as shared Endpoint device logins. ISMF Standard 94 [I3] Integrity 3 Responsible Parties should log all privileged account allocations, changes and activity for regular reviews. ISMF Standard 80 Responsible Parties should review privileged allocations and changes when significant employment changes occur, but at least every three months. ISMF Standard 77 Business Owners should authorise privileged Endpoint access (e.g. administrative privileges), and undertake a comprehensive review relative to general user access rights at least quarterly. ISMF Standard 80 INACTIVITY MEASURES FOR UNATTENDED DEVICES Devices may be to being operational but unattended for extended periods (e.g. user(s) remain loggedin with applications running). This provides easy access to the Endpoint device, its information and the environment it is connected to. Inactivity measures can reduce this risk. They limit how long an Endpoint can be unattended or inactive.
endpoint-protection-guideline18.docx