Privileged Access Management Design Security Checklist
1. Policy and Governance
2. Risk Assessment
3. User Provisioning
4. Authentication and Authorization
- Require minimum length of 12 characters.
- Mandate the use of uppercase, lowercase, numbers, and special characters.
- Implement password expiration every 90 days.
- Prohibit the reuse of the last 5 passwords.
- Encourage the use of passphrases.
- Select a reliable MFA solution (e.g., SMS, authenticator apps, hardware tokens).
- Require MFA for access to all critical systems.
- Ensure backup codes are available for account recovery.
- Educate users on the importance of MFA.
- Regularly review and update MFA settings.
- Enable logging for all authentication events.
- Store logs securely, ensuring they are tamper-proof.
- Regularly review logs for suspicious activities.
- Set up alerts for failed login attempts.
- Maintain logs for a minimum of 12 months.
- Define roles based on job functions and responsibilities.
- Assign permissions strictly based on roles.
- Regularly review and update role definitions.
- Implement the principle of least privilege.
- Document and audit role assignments periodically.
5. Session Management
- Utilize monitoring tools to observe all privileged sessions.
- Capture session metadata including user actions and timestamps.
- Ensure monitoring is in compliance with privacy and legal regulations.
- Review logs regularly for anomalies and unusual patterns.
- Log all actions taken during privileged sessions.
- Store logs securely with access controls in place.
- Ensure logs are retained for a defined period for auditing.
- Implement log integrity checks to prevent tampering.
- Define inactivity thresholds for different user roles.
- Automatically log out users after the threshold is reached.
- Notify users of impending logouts due to inactivity.
- Review and adjust timeout policies based on user feedback.
- Set up triggers for predefined suspicious behaviors.
- Alert security teams immediately for rapid response.
- Categorize alerts by severity for prioritized action.
- Regularly update alert criteria based on evolving threats.
Use in Manifestly