A04. System access permission configuration

Preface

This article willSystem access permission configuration, operation permissions for operation support personnel, super administrator account permissions, and sensitive data operation managementConduct in-depth assessments of the four key areas and put forward corresponding improvement suggestions to further enhance the effectiveness of account security and permission management.

A04.System access permission configuration

Evaluation elements:

①Whether the system platform is configured with access permission control strategy;

②Whether the business system access permission configuration meets the business requirements, security strategy, and the principle of minimum authorization;

③Whether to provide system platform access permission configuration strategy screenshot evidence.

Material requirements collection design

1.Please describe each item of the system account password security strategy configuration, and attach screenshots of the configuration situation below:

(e.g., set password complexity3types of characters8digits or more, input error5times after locking the account, the validity period of the account password is90Day)

①Application platform:

Password complexity configuration:

Account lockout strategy configuration:

Account password validity period:

Password recovery process:

②Host system:

Password complexity configuration, account lockout strategy configuration, account password validity period:

③Database:

Password complexity configuration, account lockout strategy configuration, account password validity period:

2. Please explain whether the business support system is equipped with system access authorization control measures:

£Yes      £No

If so, please specify which system access authorization control measures are adopted:

For example, in role-based access control (role-BAC), permissions are not directly assigned to users, but assigned to the roles of users. For example, an organization may have roles such as employees, managers, and administrators. Each role has a set of related permissions that define the operations that users can perform. When users are assigned to a role, they inherit the permissions of that role.

Please provide evidence of front-end application access control measures

Please provide evidence of host system access control measures

Please provide evidence of database access control measures

3.