ISO 27001:2022 Control 5.17 (A.5.17)

1. Allocation and Management of Authentication Information

The allocation and management process ensures that authentication credentials are securely created, distributed, and maintained. Specific considerations include:

• Secure Generation of Credentials: Temporary passwords or PINs generated during enrollment processes should be unique, non-guessable, and issued with a requirement for users to change them after first use. Automating this process reduces the risk of human error and ensures compliance with security best practices.

• Identity Verification: Establish procedures to confirm the identity of a user before issuing or resetting authentication credentials. For example, users may need to provide personal identifiers or use multi-factor authentication (MFA) during the identity verification process.

• Secure Transmission: Authentication credentials must be transmitted using secure channels, such as encrypted communication protocols, to prevent interception. Avoid using clear-text email or other unprotected methods for transmitting sensitive information.

• Acknowledgment of Receipt: Users should formally acknowledge receipt of their credentials. This step ensures that they are aware of their responsibilities regarding the use and protection of authentication information.

• Changing Default Credentials: Default passwords or credentials provided by vendors must be changed immediately after system installation. Failing to do so creates a significant security vulnerability.

• Record-Keeping: Maintain logs of significant events related to the allocation and management of authentication credentials. These records should be stored securely and reviewed periodically to identify potential issues or anomalies.

2. User Responsibilities

Users play a critical role in maintaining the security of authentication information. Your organization should establish clear guidelines for users, including:

• Confidentiality of Credentials: Users must ensure that passwords or other forms of authentication information remain confidential. Personal passwords should never be shared, and credentials associated with shared accounts should only be accessible to authorized individuals.

• Handling Compromised Credentials: If a user suspects that their credentials have been compromised, they must report the issue immediately and change their authentication information without delay.

• Strong Password Practices: Encourage users to follow best practices for creating secure passwords:

  • Avoid using personal information, such as names or birthdates, in passwords.
  • Use passphrases that include a mix of uppercase letters, lowercase letters, numbers, and special characters.
  • Ensure that passwords meet a minimum length requirement, such as 12 characters or more.
  • Refrain from using the same password for multiple accounts or services.

• Training and Awareness: Users should be regularly educated on the importance of authentication security and the potential risks of poor practices. Include these requirements in employment contracts and terms of service.

3. Password Management Systems

A password management system can significantly enhance the security and usability of authentication processes. Key features include:

• User Control: Enable users to create and change their own passwords, while implementing confirmation steps to reduce input errors.

• Enforcement of Policies: Automatically enforce strong password policies to ensure compliance with security standards. For example, the system should reject passwords that are too weak, commonly used, or part of known compromised databases.

• Mandatory Password Changes: Require users to change passwords after their first login, after a suspected compromise, or upon termination of employment.

• Prevention of Reuse: Prevent users from reusing previously used passwords to reduce the risk of compromised credentials.

• Secure Storage and Encryption: Store passwords using approved encryption and hashing techniques. Ensure that passwords are never stored or transmitted in plaintext.

4. Supplementary Authentication Methods

In addition to passwords, your organization should consider implementing alternative or supplementary authentication methods, such as:

• Multi-Factor Authentication (MFA): Combine something the user knows (e.g., a password) with something they have (e.g., a hardware token) or something they are (e.g., a biometric).

• Biometric Authentication: Use biometric data, such as fingerprints or facial recognition, to enhance security.

• Cryptographic Keys: Deploy cryptographic key pairs for more advanced authentication scenarios.