ISO 27002:2022, Control 5.17 – Authentication Information

Ownership of Control 5.17

Considering that Control 5.17 entails establishment and implementation of organisation-wide rules, procedures, and measures for the allocation and management of authentication information, information security officers should be responsible for compliance with Control 5.17.

Guidance on Allocation of Authentication Information

Organisations should comply with the following six requirements for allocation and management of authentication information:

• When personal passwords or personal identification numbers are generated automatically for enrolment of new users, they should be non-guessable. Furthermore, passwords should be unique to each user and it must be mandatory to change passwords after the first use.
• Organisations should establish robust procedures to authenticate the identity of a user before he/she is granted a new or replacement authentication information or he/she is provided with temporary information.
• Organisations should ensure the secure transmission of authentication information to individuals via secure channels and they should not send this information over insecure electronic messages (e.g cleartext).
• Users should confirm the receipt of the authentication information.
• After new IT systems and software programs are installed, organisations should change the default authentication information immediately.
• Organisations should establish and maintain records of all important events related to management and allocation of authentication information. Furthermore, these records should be kept confidential and record-keeping methods should be authorised such as through the use of an approved password tool.

Guidance on User Responsibilities

Users who can access to and use authentication information should be instructed to comply with the following:

1. Users must maintain the confidentiality of secret authentication information such as passwords and should not share such secret information with anyone else. When multiple users are involved in the use of authentication information or the information is linked to non-personal entities, the authentication information should not be disclosed to unauthorised persons.
2. Users must change their passwords immediately if the confidentiality of their passwords are compromised.
3. Users should select hard-to-guess strong passwords by following industry best practices. For instance:
• Passwords should not be selected based on personal information that is easy to obtain, such as names or dates of birth.
• Passwords should not be created based on anything that can be easily guessed.
• Passwords should not include dictionary words or combinations of these words.
• Alphanumeric and special characters should be used in the password.
• There should be a minimum length for passwords.
4. Users should not use the same password for different services.
5. Organisations should include the requirements for creation and use of passwords in their employment contracts with their employees.

Guidance on Password Management Systems

Organisations should comply with the following when establishing a password management system:

• Users should be allowed to create and change their passwords and there should be a confirmation procedure in place to ensure that input errors are identified and resolved.
• Organisations should implement a strong password selection process, taking into account industry best practices for password selection.
• Users should be forced to change their default passwords after they first access a system.
• Password changes should be implemented when it is necessary. For example, password change will be necessary after a security incident or following the termination of an employment with a user if that user has access to passwords.
• Previous passwords should not be reused.
• Use of highly common passwords or compromised passwords or usernames used for access to hacked systems should be prohibited.
• When passwords are entered, they should be visible on the screen in plain text.
• Passwords should be stored and transferred via protected channels and in a secure format.

Furthermore, organisations should perform hashing and encryption techniques in accordance with the authorised cryptography methods for passwords as set out in Control 8.24.

Supplementary Guidance on Control 5.17

In addition to passwords, there are other types of authentication information such as cryptographic keys, smart cards and biometric data such as fingerprints.

Organisations are advised to refer to ISO/IEC 24760 Series for more detailed guidance on authentication information.

Considering that frequent change of passwords might be cumbersome and annoying for users, organisations may consider implementing alternative methods such as single sign-on or password vaults. However, it should be noted that these alternative methods may expose authentication information to higher risk of unauthorised disclosure.

Changes and Differences from ISO 27002:2013

27002:2022/5.17 replaces 27002:2013/(9.2.4, 9.3.1 9.4.3)

The 2022 Version Contains a New Requirement for Allocation and Management of Authentication Information

Although the 2013 and the 2022 Version is highly similar in terms of the requirements for allocation and management of authentication information, the Control 5.17 in the 2022 Version introduces the following requirement, which was not included in the 2013 Version:

• Organisations should establish and maintain records of all important events related to management and allocation of authentication information. Furthermore, these records should be kept confidential and record-keeping methods should be authorised such as through the use of an approved password tool.

Control 5.17 in the 2022 Version Contains an Additional Requirement for Use of Authentication Information

Control 5.17 introduces the following requirement for user responsibilities that was not referred to in Control 9.3.1 in the 2013 Version.

• Organisations should include the requirements for creation and use of passwords in their employment contracts with their employees and staff.

The 2013 Version Contained an Additional Requirements for User Responsibilities That Was Not Included in the 2022 Version

In contrast to the 2022 Version, Control 9.3.1 contained the following requirement for use of authentication information:

• Users should not use the same authentication information such as a password for both business and non-business purposes.

The 2013 Version Contained an Additional Requirement for Password Management Systems That Was Not Included in the 2022 Version

Control 9.4.3 in the 2013 Version included the following requirement for password management systems.

• Files containing passwords should be hosted in a separate system from application system data.

Control 5.17 in the 2022 version, on the contrary, did not contain this requirement.

How ISMS.online Helps

ISMS.Online helps organisations and businesses meet the requirements of ISO 27002 by providing them with a platform that makes it easy to manage their confidentiality or non-disclosure policies and procedures, update them as needed, test them and monitor their effectiveness.

We provide a cloud-based platform for the management of Confidentiality and Information Security Management Systems, including non-disclosure clauses, risk management, policies, plans and procedures, in one central location. The platform is easy to use and has an intuitive interface that makes it simple to learn how to use.

Contact us today to schedule a demo.