AI3.2:: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| Line 28: | Line 28: | ||
:::'''3.2.2: Operating Systems'''<br> | :::'''3.2.2: Operating Systems'''<br> | ||
:::'''3.2.2.1: UNIX'''<br> | :::'''3.2.2.1: UNIX'''<br> | ||
:::'''7. Risk: Unidentifiable users may compromise critical business processes and data.'''<br> | |||
::::a. SOX.4.2.1.7: The UNIX system will not allow identical administrator IDs.<br> | |||
'''Testing Procedures'''<br> | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
Obtain a copy of the user control file from the system and verify that there are no duplicate system accounts.<br> | |||
<br> | |||
An example of this might be one of the following:<br> | |||
<br> | |||
</blockquote> | |||
:::'''3.2.2.2: WINDOWS'''<br> | :::'''3.2.2.2: WINDOWS'''<br> | ||
:::'''3.2.2.3: MAINFRAME'''<br> | :::'''3.2.2.3: MAINFRAME'''<br> | ||
:::'''3.2.2.4: AS/400'''<br> | :::'''3.2.2.4: AS/400'''<br> | ||
Revision as of 14:37, 2 May 2006
AI 3.2 Infrastructure Resource Protection and Availability
Control Objective:
Implement internal control, security and audit ability measures during configuration, integration and maintenance of hardware and infrastructural software to protect resources and ensure availability and integrity. Responsibilities for using sensitive infrastructure components should be clearly defined and understood by those who develop and integrate infrastructure components. Their use should be monitored and evaluated.
Applicability:
- Sarbanes-Oxley
- HIPAA
- GLBA
- PCI
- FISMA
- NIST SP 800-66
- Ditscap
- Control Exception
- User Defined
Risk Association Control Activities:
- 3.2.1: Infrastructure
- 3.2.1.1: Routers
- 3.2.1.2: Firewalls
- 3.2.1.3: VPN
- 3.2.1.4: Managed Switches
- 3.2.1.5: Intrusion Detection or Prevention System
- 3.2.1.1: Routers
- 3.2.1: Infrastructure
- 3.2.2: Operating Systems
- 3.2.2.1: UNIX
- 7. Risk: Unidentifiable users may compromise critical business processes and data.
- a. SOX.4.2.1.7: The UNIX system will not allow identical administrator IDs.
- a. SOX.4.2.1.7: The UNIX system will not allow identical administrator IDs.
- 3.2.2: Operating Systems
Testing Procedures
Obtain a copy of the user control file from the system and verify that there are no duplicate system accounts.
An example of this might be one of the following:
- 3.2.2.2: WINDOWS
- 3.2.2.3: MAINFRAME
- 3.2.2.4: AS/400
- 3.2.2.2: WINDOWS