Security Compliance Information Baseline

Last Revised October 1, 2020

Best Practice Logical & User Access Security Baseline Recommendations

IronOrbit security teams are operating 24/7/365 to protect the networks from unauthorized access. Their primary strategy is to restrict access to the internal networks and systems from malicious users, malware, viruses, networks and IP addresses.

The CLIENT has a major role in securing, protecting, and maintaining their environment through logical, role based, and user access controls.

By neutralizing security threats at the network level, clients can prevent unauthorized users from accessing their data and the more sensitive areas of their infrastructure.

The Following are Recommended Baseline Access Controls: 

1. Unique Users: All users must have a unique user name before being allowed access to any system components. Group, shared or generic accounts and passwords are not permitted.  All activities are to be associated with an individual.
2. User Maintenance:
   1. All change requests to a user’s access will be completed timely with their role change.
   2. All terminated user’s access will be immediately revoked.
   3. Any inactive user accounts over 90 days will be removed.
   4. User lists and access shall be reviewed quarterly for any potential changes.

3. Approval:
   1. All changes; addition, deletion and modification of user ID’s and associated access must have the approval from the Information Security Officer.
   2. Change requests to Iron Orbit should only come from specified authorized sources.
4. Password Complexity:
   1. Each user will be required to use a complex password.
   2. All first-time users must be assigned a unique password that is mandated to change on first use.
   3. All passwords will have a minimum length of 8 characters and contain both case, numeric, and special character complexity
   4. All passwords should be changed every 90 days.
   5. Changed passwords must be different than the last 6 passwords.

5. Password Sharing, Transmitting, and Storage:
   1. Passwords are not to be shared for any reason.
   2. Passwords are to be encrypted during transmission and storage on all system components. Although these both are highly discouraged.
6. Role Based Access Control: Restrict access for individuals depending on their need to perform their job function without unnecessary access to sensitive areas. A “Deny All” and then permit approach should be used.
7. Two-factor Authentication will be maintained for any and all remote access.
8. Logic Controls:
   1. Repeated access attempts will be limited by locking a user ID after no more than 6 attempts.  The lockout will remain in effect for 30 minutes.
   2. User sessions, especially remote access, that are idle for more than 15 minutes will require the user to re-authenticate their session.

9. Vendor Access: Any accounts created for vendor use to provide remote support will only be enabled for the mutually agreed upon time for service and then disabled afterwards.