Security requirements should be added to policy statements

Assignment Help Basic Computer Science
Reference no: EM13922434

The following is an extract from a corporate security policy:

Logon Procedures:

It is the responsibility of service providers, system administrators, and application developers to implement logon procedures that minimize opportunities for unauthorized access. Threshold and time periods are to be defined by the Trustee.

Logon procedures should be enabled that disclose the minimum information about the system, application, or service to avoid providing an unauthorized user with unnecessary assistance.

Logon procedures should:

  •  Not display system or application identifiers until the logon process has been successfully completed.

  •  Not disclose/display to the screen the password entered during logon.

  •  Display a specific warning that the system and/or application should only be accessed by authorized users.

  •  Not provide help messages during the logon procedure that would aid an unauthorized user.

  •  Internet-based systems must only request authentication credentials via HTTP POST method using encryption, such as TLS.

  •  Validate the logon information only upon completion of all input credentials. If an error condition arises, the system should not indicate which part of the authentication credentials is correct and which part is incorrect.

  •  Limit the number of unsuccessful logon attempts allowed before an access denial action is taken. Three attempts are recommended and in no circumstances should more than six attempts be allowed.

  •  Establish thresholds for the maximum number of denial actions within a given period before further unsuccessful logon attempts are considered a security-relevant event. Six attempts by the same logon ID or requesting device in a 24 hour period should be set as an upper threshold. Exceeding thresholds should cause one or more of the following:

  •  The authentication device is suspended or rendered inoperable until reset.

  •  The authentication device's effectiveness is suspended for a specified time period.

  •  Logging of the invalid attempts and/or a real time alert is generated.

  •  A time delay is forced before further access attempts are allowed.

  •  Limit the maximum time period allowed for the logon procedure. 20 seconds is recommended, however 30 to 40 seconds may be required for two-factor authentication.

  •  Disconnect and give no assistance after a rejected attempt to logon.

  •  Display the following information upon completion of a successful logon:

  •  Date and time of the previous successful logon.

  •  Details of any unsuccessful logon attempts since the last successful logon.

The following is an extract from a detailed set of corporate security requirements (list 2):

2.2.2          OS Logon Authentication

2.2.2.1       OS Logon Identifiers

D-SEC-120     Logon identifiers for the execution environment (e.g. operating system) shall be required for system access.

D-SEC-121     Logon functions shall require a non-blank (i.e. not NULL) user identifier for logon.

D-SEC-122     Any default identifiers shall be capable of being deleted.

D-SEC-123     Logon Identifiers shall have a minimum length of six characters containing a mix of alphabetic and numeric symbols.

D-SEC-124     Logon identifiers shall be stored in a non-volatile manner.

2.2.2.2          OS Logon Passwords

D-SEC-125     Logon Passwords shall be required for system and service access.

D-SEC-126     Logon passwords shall not be disclosed/displayed to screen, when entered during logon.

D-SEC-127     Logon password lengths shall not be disclosed/displayed to screen, when entered during logon.

D-SEC-128     Logon functions shall require a non-blank (i.e. not NULL) user password for logon.

D-SEC-129     Any default passwords shall be capable of being deleted.

D-SEC-130     Logon passwords shall have a minimum length of six characters, containing a mix of alphabetic and numeric symbols with special characters allowed.

D-SEC-131     Logon passwords shall be stored in a non-volatile manner.

D-SEC-132     Logon passwords shall be stored in hashed form only.

D-SEC-133     Logon password storage shall use the SHA1 hash algorithm at a minimum.

D-SEC-134     Logon password storage shall use the SHA-256 hash algorithm as an alternative to the SHA-1 hash algorithm.

D-SEC-135     Logon identifier verification shall use a token method as an alternative to passwords.

D-SEC-136     Logon identifier verification shall use a biometric method as an alternative to passwords.

D-SEC-137     An age threshold shall be definable for all logon passwords.

D-SEC-138     Logon passwords shall be voided when the password has exceeded the password age threshold.

D-SEC-139     The age threshold for logon passwords shall be capable of being disabled.

D-SEC-140     The minimum age threshold for logon passwords shall be 30 days.

D-SEC-141     The maximum age threshold for logon passwords shall be 999 days.

2.2.2.3            OS Logon Function (Process)

D-SEC-142     Logon functions (processes) shall support password age checking.

D-SEC-143     Logon functions shall support a settable threshold of tries a user will be given to enter a valid logon ID and password combination.

D-SEC-144     Logon functions shall support disabling the threshold of tries a user will be given to enter a valid logon ID and password combination.

D-SEC-145     The minimum threshold of tries a user will be given to enter a valid logon/password combination shall be 1 attempt.

D-SEC-146     The maximum threshold of tries a user will be given to enter a valid logon/password combination shall be 15 attempts.

D-SEC-147     Logon functions shall lock out the keyboard when the threshold for unauthorized/invalid attempts is exceeded.

D-SEC-148     Logon functions shall support a settable time interval between 1 minute and 360 minutes that controls the period of keyboard lockout following the user failure to enter a correct logon/password combination within the allocated number of attempts.

Question: Identify 5 detailed security requirements that should be added to list 2 based upon policy statements in list 1 that are NOT covered by entries already present in list 2. Be sure to identify the policy statements in list 1, then add five new requirements to list 2 based upon those policy statements.

Question: Identify 5 policy statements that should be added to list 1 based upon detailed security requirements in list 2 that are NOT covered by policy statements already present in list 1. Be sure to identify the requirements in list 2, then add five new policy statements to list 1 based upon those requirements.

Reference no: EM13922434

How many hits does this address sequence exhibit

Simulate a random replacement policy by flipping a coin. For example, "heads means to evict the first block in a set and "tails" means to evict the second block in a set. Ho

Premier products-create an inventory report

Write the SQL to retrieve a list of all customers that live in Texas (TX). Include the customer's first and last name, their account number and their representative's name a

Write a function called enter new password

In python, the question asks to write a function called enter New Password. The function takes no parameters. it prompts the user to enter a password until the entered passw

Critical importance of it in company strategy

For this assignment you will have to prepare a paper that critically discusses how organizations apply the strategic use of IS/IT to achieve competitive advantage. Some aspe

Calculate the z-score

Out of these 200 students they find that there are 134 females and 66 males. Do the numbers of males and females accepted into colleges differ significantly? Since we have a

Design gui-for-address-book

It also creates and displays a graphical user interface for an address book with a choice menu that lets users choose to which address book they want to add an entry and in

Define the knapsack problem

One such solution, for example, would be to include the items that have weights 2, 5, 9, and 14. But what if we had several thousand items of varying weights and need to fit

Discuss what the groups involved hoped to achieve

Your document should have 750-1,000 words (not including the list of works cited), but it is the quality of the answer that matters, not the number of words. Cite and refere

Reviews

Write a Review

 
Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd