Logical access privileges that pose higher risk to the function receive additional scrutiny and monitoring
Context and Guidance: Privileged access, service accounts, shared accounts, and remote access should be subject to stricter control than routine user access. Additional scrutiny might require that access requests are approved by more than one person or an individual with a higher level of authority than standard user access requests. Additional monitoring might entail logging the use of elevated privileges. As an example, in a mature organisation, privileged access to shared accounts may be implemented through provisioned credentials that are valid only for the time needed to perform an approved change. Additionally, staff may be monitored through closed-circuit television and screen captures while those credentials are in use. These are specific examples of access that may pose higher risk to the function: • privileged accounts • service accounts • shared accounts • remote access • administrative accounts • emergency access • access to sensitive assets • access to cloud or virtual asset management systems • cryptographic key management accounts • backup accounts Additionally, it is important to note that the word risk is being used in this practice in the general sense of the word and not intended to refer to any specific risks identified in the Risk Management domain of the C2M2. However, organisations should consider access to IT and OT assets and the sufficiency of controls to manage access as potential sources of risk that should be considered in the risk identification, analysis and response activities discussed in the Risk Management domain.
Related Practices • Input From: Implementing ARCHITECTURE-3a provides input that may be useful for implementing this practice. • Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ACCESS-2b, ACCESS-2g, ACCESS-2h.