Secure Authentication Information Management: ISO 27002 Control 5.17 Explained
Authentication information such as passwords, encryption keys, and card chips are the gateway to information systems that host sensitive information assets.
Poor management or improper allocation of authentication information may result in unauthorised access to information systems and in loss of confidentiality, availability, and integrity of sensitive information assets.
For example, GoodFirm’s 2021 Research shows that 30% of all data breaches occur as a result of weak passwords or poor password management practices.
Therefore, organisations should have a robust authentication information management process in place to allocate, manage and protect authentication information.
Purpose of Control 5.17
Control 5.17 enables organisations to properly allocate and manage authentication information, eliminate risks of failure in the authentication process and prevent security risks that may arise due to compromise of authentication information.
Attributes of Control 5.17
Control 5.17 is a preventive type of control that requires organisations to establish and implement an appropriate authentication information management process.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #Identity and Access Management | #Protection |
| #Integrity | ||||
| #Availability |
Ownership of Control 5.17
Considering that Control 5.17 entails establishment and implementation of organisation-wide rules, procedures, and measures for the allocation and management of authentication information, information security officers should be responsible for compliance with Control 5.17.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
Guidance on Allocation of Authentication Information
Organisations should comply with the following six requirements for allocation and management of authentication information:
- When personal passwords or personal identification numbers are generated automatically for enrolment of new users, they should be non-guessable. Furthermore, passwords should be unique to each user and it must be mandatory to change passwords after the first use.
- Organisations should establish robust procedures to authenticate the identity of a user before he/she is granted a new or replacement authentication information or he/she is provided with temporary information.
- Organisations should ensure the secure transmission of authentication information to individuals via secure channels and they should not send this information over insecure electronic messages (e.g cleartext).
- Users should confirm the receipt of the authentication information.
- After new IT systems and software programs are installed, organisations should change the default authentication information immediately.
- Organisations should establish and maintain records of all important events related to management and allocation of authentication information. Furthermore, these records should be kept confidential and record-keeping methods should be authorised such as through the use of an approved password tool.
Guidance on User Responsibilities
Users who can access to and use authentication information should be instructed to comply with the following:
- Users must maintain the confidentiality of secret authentication information such as passwords and should not share such secret information with anyone else. When multiple users are involved in the use of authentication information or the information is linked to non-personal entities, the authentication information should not be disclosed to unauthorised persons.
- Users must change their passwords immediately if the confidentiality of their passwords are compromised.
- Users should select hard-to-guess strong passwords by following industry best practices. For instance:
- Passwords should not be selected based on personal information that is easy to obtain, such as names or dates of birth.
- Passwords should not be created based on anything that can be easily guessed.
- Passwords should not include dictionary words or combinations of these words.
- Alphanumeric and special characters should be used in the password.
- There should be a minimum length for passwords.
- Users should not use the same password for different services.
- Organisations should include the requirements for creation and use of passwords in their employment contracts with their employees.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Guidance on Password Management Systems
Organisations should comply with the following when establishing a password management system:
- Users should be allowed to create and change their passwords and there should be a confirmation procedure in place to ensure that input errors are identified and resolved.
- Organisations should implement a strong password selection process, taking into account industry best practices for password selection.
- Users should be forced to change their default passwords after they first access a system.
- Password changes should be implemented when it is necessary. For example, password change will be necessary after a security incident or following the termination of an employment with a user if that user has access to passwords.
- Previous passwords should not be reused.
- Use of highly common passwords or compromised passwords or usernames used for access to hacked systems should be prohibited.
- When passwords are entered, they should be visible on the screen in plain text.
- Passwords should be stored and transferred via protected channels and in a secure format.
Furthermore, organisations should perform hashing and encryption techniques in accordance with the authorised cryptography methods for passwords as set out in Control 8.24.
Supplementary Guidance on Control 5.17
In addition to passwords, there are other types of authentication information such as cryptographic keys, smart cards and biometric data such as fingerprints.
Organisations are advised to refer to ISO/IEC 24760 Series for more detailed guidance on authentication information.
Considering that frequent change of passwords might be cumbersome and annoying for users, organisations may consider implementing alternative methods such as single sign-on or password vaults. However, it should be noted that these alternative methods may expose authentication information to higher risk of unauthorised disclosure.
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Changes and Differences from ISO 27002:2013
27002:2022/5.17 replaces 27002:2013/(9.2.4, 9.3.1 9.4.3)
The 2022 Version Contains a New Requirement for Allocation and Management of Authentication Information
Although the 2013 and the 2022 Version is highly similar in terms of the requirements for allocation and management of authentication information, the Control 5.17 in the 2022 Version introduces the following requirement, which was not included in the 2013 Version:
- Organisations should establish and maintain records of all important events related to management and allocation of authentication information. Furthermore, these records should be kept confidential and record-keeping methods should be authorised such as through the use of an approved password tool.
Control 5.17 in the 2022 Version Contains an Additional Requirement for Use of Authentication Information
Control 5.17 introduces the following requirement for user responsibilities that was not referred to in Control 9.3.1 in the 2013 Version.
- Organisations should include the requirements for creation and use of passwords in their employment contracts with their employees and staff.
The 2013 Version Contained an Additional Requirements for User Responsibilities That Was Not Included in the 2022 Version
In contrast to the 2022 Version, Control 9.3.1 contained the following requirement for use of authentication information:
- Users should not use the same authentication information such as a password for both business and non-business purposes.
The 2013 Version Contained an Additional Requirement for Password Management Systems That Was Not Included in the 2022 Version
Control 9.4.3 in the 2013 Version included the following requirement for password management systems.
- Files containing passwords should be hosted in a separate system from application system data.
Control 5.17 in the 2022 version, on the contrary, did not contain this requirement.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
ISMS.Online helps organisations and businesses meet the requirements of ISO 27002 by providing them with a platform that makes it easy to manage their confidentiality or non-disclosure policies and procedures, update them as needed, test them and monitor their effectiveness.
We provide a cloud-based platform for the management of Confidentiality and Information Security Management Systems, including non-disclosure clauses, risk management, policies, plans and procedures, in one central location. The platform is easy to use and has an intuitive interface that makes it simple to learn how to use.
Contact us today to schedule a demo.
