ISO 27002 standard has been made consistent on privacy, information security and cryptography with the Organization for Economic Co-operation and Development guidelines. ISO 27002 Code of Practice is a framework providing international best practices in information security controls and systems interoperability implemented in a variety of legal and cultural environments. ISO 27002 standard has been designed as a guidance manual for organizations implementing international best practices in information security controls. Among the listed practices, clauses around privileged access as highlighted below.
The allocation and use of privileged access rights should be restricted and controlled
Asset owners should review users’ access rights at regular intervals
Access to information and application system functions should be restricted in accordance with the access control policy
Where required by the access control policy, access to systems and applications should be controlled by a secure log-on procedure.
Password management systems should be interactive and should ensure quality passwords
Explore How Sectona Helps You Achieve Compliance with ISO 27002
Sectona privileged access management, an integrated solution with several components like privileged access, remote session collaboration, threat analytics, and session recording follows best practices in information security controls w.r.t. privileged access as intended by the ISO 27002 framework. Here are few use-cases in line with the ISO 27002:
Implement access control policy easily for system administrators accessing multiple assets and accounts. Define policies based on assets or accounts. Segregate access for default and shared accounts while demonstrating compliance.
Go beyond manual excel-sheet based reviews and review & certify access to default accounts, service accounts and other accounts with automated workflow based system.
Configure access policy definitions based on user roles & functions. Define access to critical data and enforce restrictions on a need-to-know, need-to-access basis with strong workflow based access.
Enforce second level of authentication & verification of all users by configuring customizable MFA mechanisms or free to use Sectona MFA.