Куда я попал?
Framework № PCI DSS 4.0 от 01.03.2022
Payment Card Industry Data Security Standard (RU)
Requirement 7.3.3
Для проведения оценки соответствия по документу войдите в систему.
Список требований
Похожие требования
NIST Cybersecurity Framework (RU):
PR.AC-4
PR.AC-4: При предоставлении разрешения на доступ и авторизации используется принцип наименьших привилегий и разделения обязанностей
Приказ ФСТЭК России № 21 от 18.02.2013 "Состав и содержание мер по обеспечению безопасности персональных данных, необходимых для обеспечения каждого из уровней защищенности персональных данных":
УПД.5
УПД.5 Назначение минимально необходимых прав и привилегий пользователям, администраторам и лицам, обеспечивающим функционирование информационной системы
Framework № PCI DSS 4.0 от 01.03.2022 "Payment Card Industry Data Security Standard":
Requirement 7.3.3
7.3.3
Defined Approach Requirements:
The access control system(s) is set to “deny all” by default.
Customized Approach Objective:
Access rights and privileges are prohibited unless expressly permitted.
Defined Approach Testing Procedures:
Defined Approach Requirements:
The access control system(s) is set to “deny all” by default.
Customized Approach Objective:
Access rights and privileges are prohibited unless expressly permitted.
Defined Approach Testing Procedures:
- 7.3.3 Examine vendor documentation and system settings to verify that the access control system(s) is set to “deny all” by default.
Purpose:
A default setting of “deny all” ensures no one is granted access unless a rule is established specifically granting such access.
Good Practice:
It is important to check the default configuration of access control systems because some are set by default to “allow all,” thereby permitting access unless/until a rule is written to specifically deny it.
A default setting of “deny all” ensures no one is granted access unless a rule is established specifically granting such access.
Good Practice:
It is important to check the default configuration of access control systems because some are set by default to “allow all,” thereby permitting access unless/until a rule is written to specifically deny it.
Guideline for a healthy information system v.2.0 (EN):
29 STANDARD
/STANDARD
Numerous users, including at the top management level, are tempted to ask their IT department to be able to provide them, in line with their personal use, with higher privileges on their workstations: installation of software, system configuration, etc. By default, it is recommended that an information system user, whatever his responsibility level and allocations, should not have administration privileges on his workstation. This measure, which appears restrictive, aims to limit the consequences of malicious executions from malware. The availability of a well-rounded application store, validated by the organization from the security point of view, will be able to respond to the majority of needs.
Consequently, only administrators responsible for the administration of workstations must have these rights during their interventions.
If delegating privileges to a workstation is really necessary to respond to a one-off need from the user, it must be monitored, for a limited time, and be withdrawn afterwards.
Numerous users, including at the top management level, are tempted to ask their IT department to be able to provide them, in line with their personal use, with higher privileges on their workstations: installation of software, system configuration, etc. By default, it is recommended that an information system user, whatever his responsibility level and allocations, should not have administration privileges on his workstation. This measure, which appears restrictive, aims to limit the consequences of malicious executions from malware. The availability of a well-rounded application store, validated by the organization from the security point of view, will be able to respond to the majority of needs.
Consequently, only administrators responsible for the administration of workstations must have these rights during their interventions.
If delegating privileges to a workstation is really necessary to respond to a one-off need from the user, it must be monitored, for a limited time, and be withdrawn afterwards.
Приказ ФСТЭК России № 17 от 11.02.2013 "Требования о защите информации, не составляющей государственную тайну, содержащейся в государственных информационных системах":
УПД.5
УПД.5 Назначение минимально необходимых прав и привилегий пользователям, администраторам и лицам, обеспечивающим функционирование информационной системы
Приказ ФСТЭК России № 31 от 14.03.2014 "Состав мер защиты информации и их базовые наборы для соответствующего класса защищенности автоматизированной системы управления":
УПД.5
УПД.5 Назначение минимально необходимых прав и привилегий
NIST Cybersecurity Framework (EN):
PR.AC-4
PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties
Приказ ФСТЭК России № 239 от 25.12.2017 "Состав мер по обеспечению безопасности для значимого объекта соответствующей категории значимости":
УПД.5
УПД.5 Назначение минимально необходимых прав и привилегий
Связанные защитные меры
Ничего не найдено
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.