In the beginner’s guide to ISO 27001 Identity Management you will learn
- what identity management is
- how to implement identity management for ISO 27001
I am Stuart Barker, the ISO 27001 Ninja and author of the Ultimate ISO 27001 Toolkit.
Table of contents
What is Identity Management?
Identity management is an evolution of user access management that covers the entire lifecycle of digital identities for all entities.
Identities are used to access data and resources.
It is a framework of policies, process and technologies to ensure that the right entities have the right access to the right resources.
Key Points
- Digital identities can be both human and system based
- More that one entity can access an identity
- Identities should be managed for their entire life cycle.
Human and non human identities
Human and non human identities are no longer distinct from each other. For practicable terms they are treated the same.
DO IT YOURSELF ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
Key Principles
- Identities assigned to people should ensure only that specific person is allowed to authenticate.
Through training and awareness based on having policies in place that tell people not to share login information and including the consequences of doing so.
- Unless multiple people need to access an identity as a shared identity.
Ensuring that approval processes account for shared identities and the sparing use of such identities in exceptional circumstances that are clearly documented.
- Approval processes should be in place and address human, non human, dedicated and shared identities.
With different identities in play, the approval process amounts for all of them and is documented and evidenced.
- Identities that are no longer required should be disabled and / or removed.
Processes such as the leaver process and off boarding as well as automated processes that create identities remove and or disable identities that are no longer required.
Reviews and audits are put in place to check that identities no longer required are handled appropriately in a timely manner and not left in systems.
- Duplicate identities should never be implemented.
Identities are never duplicated, they are never copied to create new identities and the rule of one user, one entity to one ID is upheld where ever possible.
- Records of events for identity management should be kept.
Events are determined as appropriate, considering creation, modification and deletion and those events once determined are record and those records are kept.
- Business Cases are created before identity creation
For the creation of all identity types a business case and / or justification is documented and included in the approval process.
- Entities are verified
In a world of zero trust, when an entity is created, modified or deleted both the requestor and the entity where relevant are appropriately verified and checked.
- Identities are established
When an identity is established it is based on the need, the request and role based access control and rarely if ever is it set up with defaults. The person establishing it is trained, experience and authorised to do so.
Identity Management Process
The identity management process is usually made up of the following process steps:
Request for the identity / access: the identity is requested by someone. This step usually includes a justification for the creation of the identity and access required.
Approval: the request is formally approved. This step is usually conducted by someone senior in the organisation in conjunction with the system and / or data owner.
Implementation: the identity is created and access granted. Default permissions are removed and modified to reflect the role based access or creation request. The user is informed via secure methods and default credentials are forced to be changed at the first opportunity.
Modification: following the structured approval process the identity is modified based on business need.
Destruction: when no longer required the identity is disabled and ultimately deleted.
ISO 27001 requirement for Identity Management
The ISO 27001 standard specifically addresses Identity Management in ISO 27001 Annex A 5.16 Identity Management
How to implement Identity Management
For a detailed guide on how to implement Identity Management, read the implementation guide ISO 27001 Annex A 5.16 Identity Management
