Password and Access Control Policy Summary
9 Questions
1 Views
3.4 Stars

Password and Access Control Policy Summary

Learn about the key responsibilities, conditions, and best practices outlined in the Password and Access Control Policy to minimize risks and safeguard sensitive assets and information. Understand the importance of user authentication, access control configurations, and the role of system administrators in enforcing policy compliance.

Created by
@CommendableRuby

Questions and Answers

Which of the following statements is true about the Password and Access Control Policy?

The policy applies to all systems and assets owned, managed, or operated by the organization.

Who is responsible for informing IT about new employees, changes to access rights, and leavers?

HR role/line managers

Who approves access requests and audits user and access lists quarterly?

Information Security Manager

What must systems administrators adhere to when making changes to access privileges?

<p>The Password and Access Control Policy</p> Signup and view all the answers

How is user authentication determined?

<p>Based on job classification and function</p> Signup and view all the answers

What setting must access control systems have by default?

<p>&quot;Deny-all&quot; setting</p> Signup and view all the answers

What is prohibited in the Password and Access Control Policy?

<p>Non-authenticated and shared/group user IDs</p> Signup and view all the answers

What is required for every user in terms of user ID and password?

<p>Every user must have a unique user ID and personal secret password.</p> Signup and view all the answers

What must be appropriate for the delivery channel in terms of user authentication mechanisms?

<p>Authentication mechanisms must be appropriate for the delivery channel.</p> Signup and view all the answers

Study Notes

Password and Access Control Policy Summary

  • The Password and Access Control Policy sets out specific responsibilities, conditions, and practices to minimize risks and protect physical assets and sensitive information.
  • The policy applies to all systems and assets owned, managed, or operated by the organization.
  • HR role/line managers inform IT of new employees, changes to access rights, and leavers.
  • The Information Security Manager approves access requests and audits user and access lists quarterly.
  • Systems administrators must adhere to the policy when making changes to access privileges and ensure systems enforce the configurations.
  • User authentication is based on job classification and function, with access granted on a need-to-know basis.
  • Access control systems must have a default "deny-all" setting.
  • Non-authenticated and shared/group user IDs are prohibited.
  • Every user must have a unique user ID and personal secret password.
  • Authentication mechanisms must be appropriate for the delivery channel.
  • Secure mechanisms for user authentication are required for operating systems, web applications, voice calls, email, faxes, and remote access.
  • Access control configurations include unique passwords, password complexity requirements, password history, lockout settings, and two-factor authentication for remote access.

Note: The remaining sections of the document were not included in the text provided.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team
Use Quizgecko on...
Browser
Browser