Requirement
Disable identifiers after a defined period of inactivity.
Assessment Objectives
- A period of inactivity after which an identifier is disabled is defined
- Identifiers are disabled after the defined period of inactivity
Potential Assessment Methods and Objects [NIST SP 800-171A]
Examine
- Identification and authentication policy
- Procedures addressing identifier management
- Procedures addressing account management
- System security plan
- System design documentation
- System configuration settings and associated documentation
- List of system accounts
- List of identifiers generated from physical access control devices
- Other relevant documents or records
Interview
- Personnel with identifier management responsibilities
- Personnel with information security responsibilities
- System or network administrators
- System developers
Test
- Mechanisms supporting or implementing identifier management
Discussion [NIST SP 800-171 REV. 2]
Inactive identifiers pose a risk to organizational information because attackers may exploit an inactive identifier to gain undetected access to organizational devices. The owners of the inactive accounts may not notice if unauthorized access to the account has been obtained.
Further Discussion
Identifiers are uniquely associated with an individual, account, process, or device. An inactive identifier is one that has not been used for a defined extended period of time. For example, a user account may be needed for a certain time to allow for transition of business processes to existing or new staff. Once use of the identifier is no longer necessary, it should be disabled as soon as possible. Failure to maintain awareness of accounts that are no longer needed yet still active could allow an adversary to exploit IT services.
Examples
Example 1
One of your responsibilities is to enforce your company's inactive account policy: any account that has not been used in the last 45 days must be disabled [a]. You enforce this by writing a script that runs once a day to check the last login date for each account and generates a report of the accounts with no login records for the last 45 days. After reviewing the report, you notify each inactive employee's supervisor and disable the account [b].
Potential Assessment Considerations
- Are user accounts or identifiers monitored for inactivity [b]?
References
- NIST SP 800-171 Rev. 2 3.5.6
