Control Objectives: Users

Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.

Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and administrator accounts. The inventory, at a minimum, should contain the person’s name, username, start/stop dates, and department. Validate that all active accounts are authorized,

Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA.

Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.

Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, review date, and purpose. Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.

Centralize account management through a directory or identity service.

Establish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, rights grant, or role change of a user

Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.

Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.

Require MFA for remote network access.

Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a third-party provider.

Establish and maintain an inventory of the enterprise’s authentication and authorization systems, including those hosted on-site or at a remote service provider. Review and update the inventory, at a minimum, annually, or more frequently.

Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.

Actively manage the life cycle of system and application accounts - their creation, use, dormancy, deletion - in order to minimize opportunities for attackers to leverage them.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location and duration.

Assign job titles and duties for handling computer and network incidents to specific individuals and ensure tracking and documentation throughout the incident through resolution.

Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in the incident response to maintain awareness and comfort in responding to real world threats. Exercises should test communication channels, decision making, and incident responders technical capabilities

Configure access for all accounts through as few centralized points of authentication as possible, including network, security, and cloud systems.

Any user or system accounts used to perform penetration testing should be controlled and monitored to make sure they are only being used for legitimate purposes, and are removed or restored to normal function after testing is over.

The processes and tools used to track/control/prevent/correct the use, assignment, and configuration of administrative privileges on computers, networks, and applications.

Create incident scoring and prioritization schema based on known or potential impact to your organization. Utilize score to define frequency of status updates and escalation procedures.

Deliver training to address the skills gap identified to positively impact workforce members' security behavior.

Designate management personnel, as well as backups, who will support the incident handling process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other workforce members to report anomalous events to the incident handling team, the mechanisms for such reporting, and the kind of information that should be included in the incident notification.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all accounts have an expiration date that is monitored and enforced.

Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities.

Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities.

Establish and follow an automated process for revoking system access by disabling accounts immediately upon termination or change of responsibilities of an employee or contractor . Disabling these accounts, instead of deleting accounts, allows preservation of audit trails.

Create a security awareness program for all workforce members to complete on a regular basis to ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of the organization. The organization's security awareness program should be communicated in a continuous

For all functional roles in the organization (prioritizing those mission-critical to the business and its security), identify the specific knowledge, skills, and abilities needed to support defense of the enterprise; develop and execute an integrated plan to assess, identify gaps, and remediate thro

Limit access to scripting tools (such as Microsoft PowerShell and Python) to only administrative or development users with the need to access those capabilities.

Automatically lock workstation sessions after a standard period of inactivity.

Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.

Assemble and maintain information on third-party contact information to be used to report a security incident, such as Law Enforcement, relevant government departments, vendors, and ISAC partners.

Use automated tools to inventory all administrative accounts, including domain and local accounts, to ensure that only authorized individuals have elevated privileges.

Maintain an inventory of all accounts organized by authentication system.

Maintain an inventory of each of the organization's authentication systems, including those located onsite or at a remote service provider.

Monitor attempts to access deactivated accounts through audit logging.

Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or to respond quickly and effectively.

Perform a skills gap analysis to understand the skills and behaviors workforce members are not adhering to, using this information to build a baseline education roadmap.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any other administrative activities and should be tied to specific machines at specific IP addresses.

Publish information for all workforce members, regarding reporting computer anomalies and incidents to the incident handling team. Such information should be included in routine employee awareness activities.

Require all remote login access to the organization's network to encrypt data in transit and use multi-factor authentication.

Require multi-factor authentication for all user accounts, on all systems, whether managed onsite or by a third-party provider.

Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.

Train employees to be able to identify the most common indicators of an incident and be able to report such an incident.

Train workforce members to be aware of causes for unintentional data exposures, such as losing their mobile devices or emailing the wrong person due to autocomplete in email.

Train the workforce on how to identify different forms of social engineering attacks, such as phishing, phone scams and impersonation calls.

Train workforce members on the importance of enabling and utilizing secure authentication.

Train workforce on how to identify and properly store, transfer, archive and destroy sensitive information.

Ensure that the organization's security awareness program is updated frequently (at least annually) to address new technologies, threats, standards and business requirements.

Use multi-factor authentication and encrypted channels for all administrative account access.

Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring administrative access. This machine will be segmented from the organization's primary network and not be allowed Internet access. This machine will not be used for reading e-mail, composing documents, or br