The following is an extract from a corporate security policy:
Logon Procedures:
It is the responsibility of service providers, system administrators, and application developers to implement logon procedures that minimize opportunities for unauthorized access. Threshold and time periods are to be defined by the Trustee.
Logon procedures should be enabled that disclose the minimum information about the system, application, or service to avoid providing an unauthorized user with unnecessary assistance.
Logon procedures should:
• Not display system or application identifiers until the logon process has been successfully completed.
• Not disclose/display to the screen the password entered during logon.
• Display a specific warning that the system and/or application should only be accessed by authorized users.
• Not provide help messages during the logon procedure that would aid an unauthorized user.
• Internet-based systems must only request authentication credentials via HTTP POST method using encryption, such as TLS.
• Validate the logon information only upon completion of all input credentials. If an error condition arises, the system should not indicate which part of the authentication credentials is correct and which part is incorrect.
• Limit the number of unsuccessful logon attempts allowed before an access denial action is taken. Three attempts are recommended and in no circumstances should more than six attempts be allowed.
• Establish thresholds for the maximum number of denial actions within a given period before further unsuccessful logon attempts are considered a security-relevant event. Six attempts by the same logon ID or requesting device in a 24 hour period should be set as an upper threshold. Exceeding thresholds should cause one or more of the following:
• The authentication device is suspended or rendered inoperable until reset.
• The authentication device's effectiveness is suspended for a specified time period.
• Logging of the invalid attempts and/or a real time alert is generated.
• A time delay is forced before further access attempts are allowed.
• Limit the maximum time period allowed for the logon procedure. 20 seconds is recommended, however 30 to 40 seconds may be required for two-factor authentication.
• Disconnect and give no assistance after a rejected attempt to logon.
• Display the following information upon completion of a successful logon:
• Date and time of the previous successful logon.
• Details of any unsuccessful logon attempts since the last successful logon.
The following is an extract from a detailed set of corporate security requirements (list 2):
2.2.2 OS Logon Authentication
2.2.2.1 OS Logon Identifiers
D-SEC-120 Logon identifiers for the execution environment (e.g. operating system) shall be required for system access.
D-SEC-121 Logon functions shall require a non-blank (i.e. not NULL) user identifier for logon.
D-SEC-122 Any default identifiers shall be capable of being deleted.
D-SEC-123 Logon Identifiers shall have a minimum length of six characters containing a mix of alphabetic and numeric symbols.
D-SEC-124 Logon identifiers shall be stored in a non-volatile manner.
2.2.2.2 OS Logon Passwords
D-SEC-125 Logon Passwords shall be required for system and service access.
D-SEC-126 Logon passwords shall not be disclosed/displayed to screen, when entered during logon.
D-SEC-127 Logon password lengths shall not be disclosed/displayed to screen, when entered during logon.
D-SEC-128 Logon functions shall require a non-blank (i.e. not NULL) user password for logon.
D-SEC-129 Any default passwords shall be capable of being deleted.
D-SEC-130 Logon passwords shall have a minimum length of six characters, containing a mix of alphabetic and numeric symbols with special characters allowed.
D-SEC-131 Logon passwords shall be stored in a non-volatile manner.
D-SEC-132 Logon passwords shall be stored in hashed form only.
D-SEC-133 Logon password storage shall use the SHA1 hash algorithm at a minimum.
D-SEC-134 Logon password storage shall use the SHA-256 hash algorithm as an alternative to the SHA-1 hash algorithm.
D-SEC-135 Logon identifier verification shall use a token method as an alternative to passwords.
D-SEC-136 Logon identifier verification shall use a biometric method as an alternative to passwords.
D-SEC-137 An age threshold shall be definable for all logon passwords.
D-SEC-138 Logon passwords shall be voided when the password has exceeded the password age threshold.
D-SEC-139 The age threshold for logon passwords shall be capable of being disabled.
D-SEC-140 The minimum age threshold for logon passwords shall be 30 days.
D-SEC-141 The maximum age threshold for logon passwords shall be 999 days.
2.2.2.3 OS Logon Function (Process)
D-SEC-142 Logon functions (processes) shall support password age checking.
D-SEC-143 Logon functions shall support a settable threshold of tries a user will be given to enter a valid logon ID and password combination.
D-SEC-144 Logon functions shall support disabling the threshold of tries a user will be given to enter a valid logon ID and password combination.
D-SEC-145 The minimum threshold of tries a user will be given to enter a valid logon/password combination shall be 1 attempt.
D-SEC-146 The maximum threshold of tries a user will be given to enter a valid logon/password combination shall be 15 attempts.
D-SEC-147 Logon functions shall lock out the keyboard when the threshold for unauthorized/invalid attempts is exceeded.
D-SEC-148 Logon functions shall support a settable time interval between 1 minute and 360 minutes that controls the period of keyboard lockout following the user failure to enter a correct logon/password combination within the allocated number of attempts.
Question: Identify 5 detailed security requirements that should be added to list 2 based upon policy statements in list 1 that are NOT covered by entries already present in list 2. Be sure to identify the policy statements in list 1, then add five new requirements to list 2 based upon those policy statements.
Question: Identify 5 policy statements that should be added to list 1 based upon detailed security requirements in list 2 that are NOT covered by policy statements already present in list 1. Be sure to identify the requirements in list 2, then add five new policy statements to list 1 based upon those requirements.