Account on a computer linked to a specific user; computer can have many user accounts (like in Windows); storage and files only pertain to the user, has limited access to the operating system; most common
. Can be used by many users (it's like guest account); can't really track individuals this way
. Used exclusively by services running on a computer (web server would have an account with certain access, database server would have others, etc)
. Have complete access to the system (admin account, root account, etc); only use as needed
. You only get exactly what is needed and nothing more; apps should only run with minimal rights
. Adding new users and making them sign AUP forms; when leaving they must follow steps in a formal process to turn in hardware and data; account deactivated
. Audits to make sure permissions are correct and usage is appropriate - can be scheduled or automated
. A good way to provide security based on when someone is somewhere
. User account naming should ensure all users are unique, yet follow a uniform and consistent and persistent naming scheme
. Should do periodic audits, forced password changes, account deactivations for users who have left, etc
. Assign users to groups, then assign persmissions to the groups; users can be members of multiple groups - can run into implicit permissions problems
. Using GPS (most accurate), 802.11 wireless location (less accurate), or IP address (least accurate) to determine access (such as restricting access if far away); firewall rules blocking countries
. The only thing standing between your data and the rest of the world
. In Windows - thousand of settings that can be configured and pushed out that control the functions of the computer; linked to Active Directory; combines user and computer name
. Mix of upper and lower case with special characters and numbers - min of 8 characters
. Should not be trivial! Make it tough do to avoid social engineering
. Happens if too many incorrect PW attempts; leave it on even for service accounts - avoids brute force attacks
.
