The following is an extract from a corporate security policy:

Logon Procedures:

It is the responsibility of service providers, system administrators, and application developers to implement logon procedures that minimize opportunities for unauthorized access. Threshold and time periods are to be defined by the Trustee.

Logon procedures should be enabled that disclose the minimum information about the system, application, or service to avoid providing an unauthorized user with unnecessary assistance.

Logon procedures should:

  •  Not display system or application identifiers until the logon process has been successfully completed.

  •  Not disclose/display to the screen the password entered during logon.

  •  Display a specific warning that the system and/or application should only be accessed by authorized users.

  •  Not provide help messages during the logon procedure that would aid an unauthorized user.

  •  Internet-based systems must only request authentication credentials via HTTP POST method using encryption, such as TLS.

  •  Validate the logon information only upon completion of all input credentials. If an error condition arises, the system should not indicate which part of the authentication credentials is correct and which part is incorrect.

  •  Limit the number of unsuccessful logon attempts allowed before an access denial action is taken. Three attempts are recommended and in no circumstances should more than six attempts be allowed.

  •  Establish thresholds for the maximum number of denial actions within a given period before further unsuccessful logon attempts are considered a security-relevant event. Six attempts by the same logon ID or requesting device in a 24 hour period should be set as an upper threshold. Exceeding thresholds should cause one or more of the following:

  •  The authentication device is suspended or rendered inoperable until reset.

  •  The authentication device's effectiveness is suspended for a specified time period.

  •  Logging of the invalid attempts and/or a real time alert is generated.

  •  A time delay is forced before further access attempts are allowed.

  •  Limit the maximum time period allowed for the logon procedure. 20 seconds is recommended, however 30 to 40 seconds may be required for two-factor authentication.

  •  Disconnect and give no assistance after a rejected attempt to logon.

  •  Display the following information upon completion of a successful logon:

  •  Date and time of the previous successful logon.

  •  Details of any unsuccessful logon attempts since the last successful logon.

The following is an extract from a detailed set of corporate security requirements (list 2):

2.2.2          OS Logon Authentication

2.2.2.1       OS Logon Identifiers

D-SEC-120     Logon identifiers for the execution environment (e.g. operating system) shall be required for system access.

D-SEC-121     Logon functions shall require a non-blank (i.e. not NULL) user identifier for logon.

D-SEC-122     Any default identifiers shall be capable of being deleted.

D-SEC-123     Logon Identifiers shall have a minimum length of six characters containing a mix of alphabetic and numeric symbols.

D-SEC-124     Logon identifiers shall be stored in a non-volatile manner.

2.2.2.2          OS Logon Passwords

D-SEC-125     Logon Passwords shall be required for system and service access.

D-SEC-126     Logon passwords shall not be disclosed/displayed to screen, when entered during logon.

D-SEC-127     Logon password lengths shall not be disclosed/displayed to screen, when entered during logon.

D-SEC-128     Logon functions shall require a non-blank (i.e. not NULL) user password for logon.

D-SEC-129     Any default passwords shall be capable of being deleted.

D-SEC-130     Logon passwords shall have a minimum length of six characters, containing a mix of alphabetic and numeric symbols with special characters allowed.

D-SEC-131     Logon passwords shall be stored in a non-volatile manner.

D-SEC-132     Logon passwords shall be stored in hashed form only.

D-SEC-133     Logon password storage shall use the SHA1 hash algorithm at a minimum.

D-SEC-134     Logon password storage shall use the SHA-256 hash algorithm as an alternative to the SHA-1 hash algorithm.

D-SEC-135     Logon identifier verification shall use a token method as an alternative to passwords.

D-SEC-136     Logon identifier verification shall use a biometric method as an alternative to passwords.

D-SEC-137     An age threshold shall be definable for all logon passwords.

D-SEC-138     Logon passwords shall be voided when the password has exceeded the password age threshold.

D-SEC-139     The age threshold for logon passwords shall be capable of being disabled.

D-SEC-140     The minimum age threshold for logon passwords shall be 30 days.

D-SEC-141     The maximum age threshold for logon passwords shall be 999 days.

2.2.2.3            OS Logon Function (Process)

D-SEC-142     Logon functions (processes) shall support password age checking.

D-SEC-143     Logon functions shall support a settable threshold of tries a user will be given to enter a valid logon ID and password combination.

D-SEC-144     Logon functions shall support disabling the threshold of tries a user will be given to enter a valid logon ID and password combination.

D-SEC-145     The minimum threshold of tries a user will be given to enter a valid logon/password combination shall be 1 attempt.

D-SEC-146     The maximum threshold of tries a user will be given to enter a valid logon/password combination shall be 15 attempts.

D-SEC-147     Logon functions shall lock out the keyboard when the threshold for unauthorized/invalid attempts is exceeded.

D-SEC-148     Logon functions shall support a settable time interval between 1 minute and 360 minutes that controls the period of keyboard lockout following the user failure to enter a correct logon/password combination within the allocated number of attempts.

Question: Identify 5 detailed security requirements that should be added to list 2 based upon policy statements in list 1 that are NOT covered by entries already present in list 2. Be sure to identify the policy statements in list 1, then add five new requirements to list 2 based upon those policy statements.

Question: Identify 5 policy statements that should be added to list 1 based upon detailed security requirements in list 2 that are NOT covered by policy statements already present in list 1. Be sure to identify the requirements in list 2, then add five new policy statements to list 1 based upon those requirements.