Find Resources & Connect with members on topics that interest you.

Applications

Audit

Business Processes

Career Management

Cloud Computing/Virtualization

COBIT

Controls and Monitoring

Country

Databases

Fraud and Computer Crime

Governance and Management

Industry

Information Security

IT Service Management

Mobile/Wireless

Operating Systems

Privacy/Data Protection

Regulations

Risk

Standards

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

ME - Monitor and Evaluate

Application Controls

Process Controls

Please sign in to see your topics.

You must be logged in to join this group.

DS5.4 - User Account Management

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective DS5.4 - User Account Management is contained within Process Popup Ensure Systems Security.

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
16 Members
0 Online
2653 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

User Account Management

Address requesting, establishing, issuing, suspending, modifying and closing user accounts and related user privileges with a set of user account management procedures. Include an approval procedure outlining the data or system owner granting the access privileges. These procedures should apply for all users, including administrators (privileged users) and internal and external users, for normal and emergency cases. Rights and obligations relative to access to enterprise systems and information should be contractually arranged for all types of users. Perform regular management review of all accounts and related privileges.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Consistently managed and administered user accounts
  • Rules and regulations for all kinds of users
  • Timely discovery of security incidents
  • Protection of IT systems and confidential data from unauthorised users
  Risk Drivers
  • Security breaches
  • Users failing to comply with security policy
  • Incidents not solved in a timely manner
  • Failure to terminate unused accounts in a timely manner, thus impacting corporate security

View Control Practices  help

Hide Control Practices  help

  1. Ensure that access control procedures include but are not limited to:
    • Using unique user IDs to enable users to be linked to and held accountable for their actions
    • Awareness that the use of group IDs results in the loss of individual accountability and are permitted only when justified for business or operational reasons and compensated by mitigating controls. Group IDs must be approved and documented.
    • Checking that the user has authorisation from the system owner for the use of the information system or service, and the level of access granted is appropriate to the business purpose and consistent with the organisational security policy
    • A procedure to require users to understand and acknowledge their access rights and the conditions of such access
    • Ensuring that internal and external service providers do not provide access until authorisation procedures have been completed
    • Maintaining a formal record, including access levels, of all persons registered to use the service
    • A timely and regular review of user IDs and access rights
  2. Ensure that management reviews or reallocates user access rights at regular intervals using a formal process. User access rights should be reviewed or reallocated after any job changes, such as transfer, promotion, demotion or termination of employment. Authorisations for special privileged access rights should be reviewed independently at more frequent intervals.

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 82 total

Must be a Topic member to contribute
View All »
Books
Once more unto the Breach: Managing Information Security in an Uncertain World
Posted by ISACA 3 days ago
Books
Illustrating PRINCE2: Project Management in Real Terms
Posted by ISACA 3 days ago
Books
Information Security Governance Simplified: From the Board room to the Key Board
Posted by ISACA 3 days ago
Research
Responding to Targeted Cyberattacks
Posted by ISACA 5 days ago
Research
Cloud Governance: Questions Boards of Directors Need to Ask
Posted by ISACA 29 days ago
Research
Engagement with Private Sector on Cyber Security
Posted by ISACA 39 days ago
View All »

Events & Online Learning: 8 total

View All »
29 Oct 2012
ISACA International Event
Information Security Essentials for IT Auditors-New York CIty
New York, NY, USA
More »
Add to my Outlook
24 Apr 2013
Online
Virtual Conference: The State of Cybersecurity
online
More »
Add to my Outlook
10 Jun 2013
ISACA International Event
INSIGHTS 2013: ISACA's World Congress
Berlin, Germany
Early bird deadline has been extended: save over US $350 when you register by 1 May. Learn from industry-leading IT experts at Insights 2013. This is a unique opportunity to discover revolutionary new ideas at the world’s premier business event.
More »
Add to my Outlook
Register Now
22 Jul 2013
ISACA International Event
Information Security Essentials for IT Auditors-Seattle
Seattle, WA, USA
More »
Add to my Outlook
Register Now
16 Sep 2013
ISACA International Event
2013 EuroCACS / ISRM
London, England
Stay on top of the trends and opportunities of the dynamic technology industry at EuroCACS/ISRM 2013 in Berlin—the leading European conference for IT audit, assurance, security and risk professionals. Save over US $200 when you register by 22 July!
More »
Add to my Outlook
Register Now
30 Sep 2013
ISACA International Event
Conferencia Latinoamericana
Medellín, Colombia
La Conferencia Latinoamericana CACS/ISRM 2013 en Medellín, Colombia es la conferencia principal latinoamericana para los profesionales de auditoría, riesgo y seguridad de la información. Ahorre más de EE.UU. $ 100 si se inscribe antes del 7 de agosto!
More »
Add to my Outlook
Register Now
View All »

Journal Articles: 263 total

View All »
Volume 3, 2013
Pushing Back the Rain—How to Create Trustworthy Services in the Cloud
by Dan Bogdanov, Ph.D., and Aivo Kalu, Ph.D., CISA
A cloud is a remote-access platform; thus, technical controls that remotely enforce a particular security policy are especially efficient.
Volume 2, 2013
Just Okay Practice
by Steven J. Ross, CISA, CISSP, MBCP
Organizations should never aspire to being standard in any endeavor.
Volume 1, 2013
Mean Times
by Steven J. Ross, CISA, CISSP, MBCP
Emerging cyberattacks against the US’s critical infrastructures are rapidly outstripping the ability of security and risk management professionals to maintain high availability and uptime assurances.
Volume 6, 2012
The Changing Face of Cybersecurity
by Stewart Hayes, Malcolm Shore and Miles Jakeman, Ph.D.
The Internet has a well-earned reputation as a hostile environment, and the growth of organised cybercrime is evidence that there is not enough being done to manage the risk.
Volume 6, 2012
The Cost of Cyberattacks
by Steven J. Ross, CISA, CISSP, MBCP
From a purely financial standpoint, what would a widespread cyberattack look like should it be broadly targeted on the economy of an entire nation?
Volume 6, 2012
Lack of Privacy Awareness in Social Networks
by S. Srinivasan
Social networks have opened up a new avenue of communication for millions of people around the world.
View All »

User Contributed External Links: 0 total

Wikis: 2 total

Blog Posts: 41 total

View All »
22 Apr 2013
Payments to invalid recepients resulting in fraud
A recent publication in a local newspaper, indicated that an employee was charged with fraud with regards to claims of insurance payments that were lodged with the company were paid out to people who were not entitled to receive such payments. What po...
Posted By : Paulina.PNI | 1 comments
18 Mar 2013
VENEZUELA, Cursos de Preparación Examenes CISA, CISM, CRISC, COBIT
Grupos de Estudio para Acreditaciones de JUNIO, SEPTIEMBRE Y DICIEMBRE 2013. Para los que esten interesados en la presentación del exámen de certificación CISA y CISM  o para cualquiera que desee comenzar a prepararse para estas o las próximas pruebas, pu...
Posted By : Alexander Osorio | 0 comments
24 Feb 2013
Legislation to combat crime in cyberspace (cyber-terrorism in Colombia)
(By: William Darío Ávila Díaz, PhD) Colombia is the first Latin American country to adopt cyberspace strategy to prevent and tackle crime and minimize the risk level of citizens from threats or incidents of cyber nature. This is why they were created th...
Posted By : William733 | 0 comments
24 Feb 2013
Terrorism on the Internet (cyber-terrorism in Colombia)
(By: William Darío Ávila Díaz, PhD) Situation: [1]On September 21, 2011, the website of the House of Representatives of the Republic of Colombia, was attacked by the "Colectivo Nacional Anonymous", who kept for several hours off duty. The engineers of ...
Posted By : William733 | 0 comments
24 Feb 2013
Criminal gangs (cyber-terrorism in Colombia)
(By: William Darío Ávila Díaz, PhD) Criminal gangs (also called BACRIM)[1]: Emerging criminal gangs emerge, the process of mobilizing the "Self-defense Forces of Colombia" (AUC), or paramilitaries, which began in 2003. These are the new paramilitary BACR...
Posted By : William733 | 0 comments
24 Feb 2013
The articulation of a trilogy in the security strategy (cyber-terrorism in Colombia)
(By: William Darío Ávila Díaz, PhD) During the National Forum on National Security and Defence held on August 30, 2011 in Barranquilla, Teatro José Consuegra Higgins, the head of the Joint Chiefs, General Luis Felipe Paredes, spoke about the advances in ...
Posted By : William733 | 0 comments
View All »
Report An Issue