Identity and Access Management

Each organization selects a standard on how to define and manage user identities

1. your organization selected [email protected] as User Identity
2. your organization can create aliases for the user identity only with prior approval and justification for a business need. Example: simplifying an email address for the ease of communication ([email protected])
3. Access to your organization systems is done through the use of at least the user identity and password
4. Users must set strong passwords based on the your organization Password Policy
5. Passwords are not displayed anywhere, transmitted unencrypted, or stored in plain text
6. your organization selected to group users by departments (Sales, Marketing, Business, Security and Development). Each user identity is added to one or more groups in the IdP solution, depending on their roles

• It is the responsibility of the Security Team to manage access to applications and systems
• your organization is using an IdP to manage access to systems and applications
• Authentication is preferred using SSO instead of local auth.

The purpose of Multi‐Factor Authentication (MFA) is to enable a means of strong authentication for those users with access to sensitive information and information systems resources or that have a privileged level of system support access while ensuring ease of use and adoption for the user(s). This will reduce the likelihood of unauthorized access, provide demonstrated compliance to federal and industry mandates, as well as enable the solicitation, assessment, and selection of MFA solutions that will implement the requirements of this policy.

Users will use the MFA self-enrollment process to register their authentication device(s) and install an MFA application (such as Google Authenticator, Microsoft Authenticator, or similar). The process guide for registration is located in the IdP documentation page.

MFA methods

• Hardware MFA token, for the Executives and IT Operations on Production Environments
• One-Time Password (time-based) using Google Authenticator, Microsoft Authenticator, or similar
• IdP mobile app for authentication

The your organization Security team adheres to a formal access control procedure that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.

As "Complexity is the enemy of security", authorization must be configured using attribute-based access control (ABAC) or role-based access control (RBAC) mechanisms.

1. Access to your organization systems is made as part of the user onboarding process, initiated by HR:

   • A new ticket is created in the onboarding project
   • The HR Team must attach the New Joiner Request Form which states the role and additional systems the new joiner must have access granted for
   • The Security Team picks up the ticket and starts evaluating the access request

2. The Security Team must:

   • Configure IT and Cloud Services to enforce strong passwords based on the your organization Password Policy
   • Establish conditions for group membership
   • Review accounts periodically or at least annually
   • Provide clear classification for data and systems
   • Not grant access to any Production environments by default

3. Once approved, the accounts are created with temporary passwords and are forced to change their password at first login.

4. For Local accounts on laptops/workstations, your organization uses Azure AD and users must be added to designated groups.

5. Online accounts are provisioned in the IdP

6. Accounts are created by default for the following services:

   • Productivity solution account for productivity and access to email, office suite, collaboration, etc.
   • Developers receive VPN Access for access to the internal your organization infrastructure
     • CI/CD
     • VCS
   • Ticket management
   • Company Wiki
   • HR solution for paperwork, payroll, expense reporting, etc.
   • Time management solution for timesheets and logging work

   Additional access can be requested in another ticket and must include a justification.

7. Access control for Mobile Devices is defined in the Mobile Device Management Policy

8. Guest access to your organization IT and Cloud Systems is permitted only if it is approved by the Security Team

For each New Joiner, there is a master checklist in the ticketing solution that must be filled out by the Security Team after access has been granted.

Access termination is received as a ticket assigned to the Security Team. Access termination can result from:

• Access is no longer required for the user to perform a specific function on a protected system
• Access has not been used for more than 90 days, in which case your organization Security Team assumes it is not required anymore (has no function)
• An access review based on the Systems Audit Policy may terminate access rights
• Employee/Contractor leaving or terminating the relationship with your organization

Tasks for Security Team:

• Password must be changed to strong random ones following the Password Policy
• For security and auditing reasons, accounts are disabled and deleted only after 1 year after the person left your organization.
• For each Leaver, there is a master checklist in the ticketing solution that must be filled out by the Security Team after access to all systems has been revoked.

Privileged User/Accounts is a User/Account that by function, and/or by seniority, has been allocated powers within the computer system, which are significantly greater than those available to the majority of users. Such entities are either root accounts on Linux systems, administrator accounts on Windows, or highly privileged users in the Cloud Service Providers.

In defining access control for groups and individuals, your organization adopts the concept of least privilege, allowing only authorized access for users (and processes acting on behalf of users) which is necessary to accomplish assigned tasks following organizational missions and business functions. In case Privileged Access is needed, accessing the system is done using the user identity of the employee/contractor, then switching to the privileged user.

your organization is using Device Management tools (Microsoft Intune, Jamf Pro, VMWare AirWatch, or similar) for company-owned devices. Guidelines are encouraged (and sometimes enforced) to ensure that these devices have been kept up to date and that they have the proper access configured:

1. Endpoints must have antivirus/endpoint security agents installed and configured to avoid malware infiltration
2. Firewall is a requirement which is pushed and audited by the device management tool
3. Hard drives and other removable media will be encrypted - see Data Protection Policy
4. Engaging in any illegal activity is strictly prohibited (hacking, crypto mining, racism, discriminations, harassments, etc.)
5. Periodic assessments, as defined in the Systems Audit Policy, are performed and may result in access being suspended or terminated in case of non-compliance with your organization's Mobile Device Management Policy

Access to your organization information systems should be locked after periods of inactivity or upon receiving a request from a user. The session lock must be retained until the user re-establishes access using established identification and authentication procedures.

• your organization follows the principle of Zero Trust Software-Defined Perimeter (SDP) and has implemented an SDP solution that helps with micro-segmentation of the access to network and cloud resources
• Developers receive VPN Access for access to the internal your organization infrastructure
• VPN access to Production environments is restricted and can be proxied only using a Bastion Service

your organization manages and grants access to wireless networks based on:

• Access to Wireless Networks is managed and pushed automatically on devices using MDM - See Mobile Device Management Policy
• Wireless connection is encrypted using WPA2 encryption or higher;
• Connection to insecure networks (unsecured wireless hotspots) is not allowed for company-owned devices unless the device does not proxy the traffic using a VPN connection
• Wireless guest access is separated from the your organization main network