Find Resources & Connect with members on topics that interest you.

Applications

Audit

Business Processes

Career Management

Cloud Computing/Virtualization

COBIT

Controls and Monitoring

Country

Databases

Exam Communities

Fraud and Computer Crime

Governance and Management

Industry

Information Security

IT Service Management

Mobile/Wireless

Operating Systems

Privacy/Data Protection

Regulations

Risk

Standards

Access Control

Application Controls

Application Security

Audit Guidelines

Audit Standards

Audit Tools and Techniques

Basel

Big Data

Business Analytics/Intelligence

Business Continuity-Disaster Recovery Planning

Business Process Management

Career Management

Casinos and Gambling

CGEIT Exam Study Community 2013

Change Management

CISA Exam Study Community 2013

CISM Exam Study Community 2013

Cloud Computing

COBIT (4.1 and earlier) - Use it Effectively

COBIT (4.1 and earlier) Implementation

COBIT 5 - Implementation

COBIT 5 - Use It Effectively

Compliance

Computer Crime

Continuous Monitoring/Auditing

Controls Monitoring

CRISC Exam Study Community 2013

CyberSecurity

Enterprise Architecture

Enterprise Data Management

Financial Reporting Compliance

Forensics

Frameworks

Fraud

Governance of Enterprise IT

Green IT

Healthcare

HIPAA

HP Non-Stop (Tandem)

Identity Management

IFRS

Incident Management

India

Information Security Management

Information Security Policies/Procedures

Intrusion Prevention/Detection

ISAE 3402

ISO/IEC 20000

ISO/IEC 27000 Series

ISO/IEC 38500

ITIL

J-SOX

Mobile Computing

Network Security

Oracle

Oracle Database

Oracle E-Business Suite

OS/400

PCI DSS

PeopleSoft

Performance Measurement

Physical Security

Privacy/Data Protection

Project/Program/Portfolio Management (P3M)

Quality Standards

Risk Assessment

Risk Management

SAP

Sarbanes-Oxley (SOX)

Security Tools

Security Trends

Service Management

SharePoint

Solvency II

SQL Server

Strategic Planning/Alignment

Students

Unix-like

Value Delivery

Virtualization

Windows

Wireless

XBRL

Young Professionals

z/OS-OS/390

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

ME - Monitor and Evaluate

Application Controls

Process Controls

Please sign in to see your topics.

You must be logged in to join this group.

DS5.3 - Identity Management

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective DS5.3 - Identity Management is contained within Process Popup Ensure Systems Security.

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
10 Members
0 Online
2688 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

Identity Management

Ensure that all users (internal, external and temporary) and their activity on IT systems (business application, IT environment, system operations, development and maintenance) are uniquely identifiable. Enable user identities via authentication mechanisms. Confirm that user access rights to systems and data are in line with defined and documented business needs and that job requirements are attached to user identities. Ensure that user access rights are requested by user management, approved by system owners and implemented by the security-responsible person. Maintain user identities and access rights in a central repository. Deploy cost-effective technical and procedural measures, and keep them current to establish user identification, implement authentication and enforce access rights.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Effective implementation of changes
  • Proper investigation of improper access activity
  • Secure communication ensuring approved business transactions
   Risk Drivers
  • Unauthorised changes to hardware and software
  • Access management failing business requirements and compromising the security of business-critical systems
  • Unspecified security requirements for all systems
  • Segregation-of-duty violations
  • Compromised system information

View Control Practices  help

Hide Control Practices  help

  1. Establish and communicate policies and procedures to uniquely identify, authenticate and authorise access mechanisms and access rights for all users on a need-to-know/need-to-have basis, based on predetermined and preapproved roles. Clearly state accountability of any user for any action on any of the systems and/or applications involved.
  2. Ensure that roles and access authorisation criteria for assigning user access rights take into account:
    • Sensitivity of information and applications involved (data classification)
    • Policies for information protection and dissemination (legal, regulatory, internal policies and contractual requirements)
    • Roles and responsibilities as defined within the enterprise
    • The need-to-have access rights associated with the function
    • Standard but individual user access profiles for common job roles in the organisation
    • Requirements to guarantee appropriate segregation of duties
  3. Establish a method for authenticating and authorising users to establish responsibility and enforce access rights in line with sensitivity of information and functional application requirements and infrastructure components, and in compliance with applicable laws, regulations, internal policies and contractual agreements.
  4. Define and implement a procedure for identifying new users and recording, approving and maintaining access rights. This needs to be requested by user management, approved by the system owner and implemented by the responsible security person.
  5. Ensure that a timely information flow is in place that reports changes in jobs (i.e., people in, people out, people change). Grant, revoke and adapt user access rights in co-ordination with human resources and user departments for users who are new, who have left the organisation, or who have changed roles or jobs.

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 97 total

Events & Online Learning: 8 total

View All »
14 May 2012
ISACA International Event
Network Security Auditing-Chicago
Chicago, IL, USA
More »
Add to my Outlook
29 Oct 2012
ISACA International Event
Information Security Essentials for IT Auditors-New York CIty
New York, NY, USA
More »
Add to my Outlook
10 Jun 2013
ISACA International Event
INSIGHTS 2013: ISACA's World Congress
Berlin, Germany
Early bird deadline has been extended: save over US $350 when you register by 1 May. Learn from industry-leading IT experts at Insights 2013. This is a unique opportunity to discover revolutionary new ideas at the world’s premier business event.
More »
Add to my Outlook
22 Jul 2013
ISACA International Event
Information Security Essentials for IT Auditors-Seattle
Seattle, WA, USA
More »
Add to my Outlook
Register Now
16 Sep 2013
ISACA International Event
2013 EuroCACS / ISRM
London, England
Stay on top of the trends and opportunities of the dynamic technology industry at EuroCACS/ISRM 2013—the leading European conference for IT audit, assurance, security and risk professionals. Save over US $200 when you register by 22 July!
More »
Add to my Outlook
Register Now
30 Sep 2013
ISACA International Event
Conferencia Latinoamericana
Medellín, Colombia
La Conferencia Latinoamericana CACS/ISRM 2013 en Medellín, Colombia es la conferencia principal latinoamericana para los profesionales de auditoría, riesgo y seguridad de la información. Ahorre más de EE.UU. $ 100 si se inscribe antes del 7 de agosto!
More »
Add to my Outlook
Register Now
View All »

Journal Articles: 274 total

View All »
Volume 3, 2013
Pushing Back the Rain—How to Create Trustworthy Services in the Cloud
by Dan Bogdanov, Ph.D., and Aivo Kalu, Ph.D., CISA
A cloud is a remote-access platform; thus, technical controls that remotely enforce a particular security policy are especially efficient.
Volume 3, 2013
JOnline: Phishing Should Not be Treated the Same as Common Spam
by Norman M. Sadeh, Ph.D.
In the US alone, phishing attacks on customers have been reported to result in direct financial losses of several billion US dollars per year.
Volume 2, 2013
Securing Merchant Environments Is Good, Securing the Credit Card Itself Is Better
by Ali Alaswad, ITIL, PMPG, PMP
The advent of the Payment Card Industry Data Security Standard (PCI DSS) resulted in many organizations mandating its use.
Volume 2, 2013
Just Okay Practice
by Steven J. Ross, CISA, CISSP, MBCP
Organizations should never aspire to being standard in any endeavor.
Volume 1, 2013
Mean Times
by Steven J. Ross, CISA, CISSP, MBCP
Emerging cyberattacks against the US’s critical infrastructures are rapidly outstripping the ability of security and risk management professionals to maintain high availability and uptime assurances.
Volume 6, 2012
The Changing Face of Cybersecurity
by Stewart Hayes, Malcolm Shore and Miles Jakeman, Ph.D.
The Internet has a well-earned reputation as a hostile environment, and the growth of organised cybercrime is evidence that there is not enough being done to manage the risk.
View All »

User Contributed External Links: 0 total

Wikis: 2 total

Blog Posts: 40 total

View All »
17 Jun 2013
Modelos de Inteligencia Computacional aplicados al diseño e investigación de Sistema de Detección de Intrusos
Resumen El imparable crecimiento de internet en el mundo, y la integración de los diversos sistemas informáticos conectados a la red de Internet han hecho que la Seguridad de la Información alcance un papel de suma importancia actualmente. Desde el moment...
Posted By : ArthurHuamani | 0 comments
22 Apr 2013
Payments to invalid recepients resulting in fraud
A recent publication in a local newspaper, indicated that an employee was charged with fraud with regards to claims of insurance payments that were lodged with the company were paid out to people who were not entitled to receive such payments. What po...
Posted By : Paulina.PNI | 1 comments
18 Mar 2013
VENEZUELA, Cursos de Preparación Examenes CISA, CISM, CRISC, COBIT
Grupos de Estudio para Acreditaciones de JUNIO, SEPTIEMBRE Y DICIEMBRE 2013. Para los que esten interesados en la presentación del exámen de certificación CISA y CISM  o para cualquiera que desee comenzar a prepararse para estas o las próximas pruebas, pu...
Posted By : Alexander Osorio | 0 comments
24 Feb 2013
Legislation to combat crime in cyberspace (cyber-terrorism in Colombia)
(By: William Darío Ávila Díaz, PhD) Colombia is the first Latin American country to adopt cyberspace strategy to prevent and tackle crime and minimize the risk level of citizens from threats or incidents of cyber nature. This is why they were created th...
Posted By : William733 | 0 comments
24 Feb 2013
Terrorism on the Internet (cyber-terrorism in Colombia)
(By: William Darío Ávila Díaz, PhD) Situation: [1]On September 21, 2011, the website of the House of Representatives of the Republic of Colombia, was attacked by the "Colectivo Nacional Anonymous", who kept for several hours off duty. The engineers of ...
Posted By : William733 | 0 comments
24 Feb 2013
Criminal gangs (cyber-terrorism in Colombia)
(By: William Darío Ávila Díaz, PhD) Criminal gangs (also called BACRIM)[1]: Emerging criminal gangs emerge, the process of mobilizing the "Self-defense Forces of Colombia" (AUC), or paramilitaries, which began in 2003. These are the new paramilitary BACR...
Posted By : William733 | 0 comments
View All »
Report An Issue