What to cover to demonstrate regulatory compliance of access rights in Active Directory

I. Scope Definition – What IT resources to include in your Active Directory regulatory compliance report.

1. User Accounts

   Include the domain user account of every individual who has Read or Modify access to any IT asset that falls under the purview of the applicable regulation.

   For instance, in the case of SOX compliance, domain user accounts of all individuals who can read or modify or authorize changes to material financial information (e.g. residing in a file / database / other medium) such as financial earnings reports and the like, must be included in your assessment.

   Typical examples include the Chief Financial Officer's (CFOs) and the Financial Controller's user account etc.

   
   
   

2. Security Groups

   Include every domain security group that is being used to provision access to any IT asset that falls under the purview of the applicable regulation.

   For instance, in the case of SOX compliance, if in a fictional organization, a fictional group called Financial Controllers was being used to provision access to a financial database (or to a file server etc.) that contains material information (such earnings release numbers), this group must be included in the assessment.

   Certain organizations may, at their discretion, additionally choose to include vital administrative groups such as Domain Admins etc. that have administrative access over the entire IT infrastructure, in their assessment.

   
   
   

3. Domain Root Object

   The domain root object of every domain that contains a user account that falls under the assessment purview must be included, so as to cover the security of specific user authentication policies protecting these user accounts.

   In particular, user authentication policies that govern the protection afforded to user passwords and account lockouts needs to be included. These policies include Maximum Password Age, Minimum Password Age, Account Lockout Duration, Account Lockout Threshold and Account Lockout Observation Window.

   These policies need to be included because if mis-configured, whether accidentally, intentionally or maliciously, they could weaken the security afforded to domain user accounts and consequently weaken and jeopardize the security afforded to material information that falls under the purview of a stipulated regulation.

   The Domain Root object needs to be included because these policies are stored as attributes of this object.





4. Organizational Units (OUs)

   Include every OU within which reside the computer accounts of those computers on which IT assets (files, databases etc.) that fall under the purview of the applicable regulation are stored.

   For instance, in the case of SOX compliance, if in a fictional organization, a fictional server named Financial Server hosts a database or an application that contains material information (such as confidential earnings release numbers), then the OU in which the computer account of this server resides must be included in the assessment.

   The is because anyone who can modify group policies linked to this OU could in effect modify this host's security policy and consequently modify the security protecting material information residing on this server.

   
   
   

5. Service Connection Points [Optional]

   Organizations need to include service connection points (SCPs) only if there exist one or more specific applications in their environment that store or protect (or play a role in provisioning access to) material information that falls under the purview of a stipulated regulation.

   In such cases, SCPs need to be included, because the enactment of certain administrative tasks on these SCPs could lead to a denial-of-service attack or result in a situation where clients could be maliciously redirected to fake versions of the service, in effect weakening the security afforded to material information.

   The decision as to whether or not to include SCPs in the compliance assessment scope is discretionary.

II. Task Coverage – Which administrative tasks to cover in your Active Directory regulatory compliance report.

The following administrative tasks should be covered in a regulatory compliance report that documents the grant of access rights in Active Directory –

WARNING – THE INFORMATION PRESENTED ON THIS WEBSITE IS COPYRIGHTED MATERIAL. NO PART OF THIS INFORMATION MAY BE REPRODUCED UNLESS IT IS CLEARLY AND EXPLICITLY ACKNOWLEDGED THAT THIS WEBSITE IS THE ORIGINAL SOURCE AND THAT A LINK TO THIS WEBSITE IS PROVIDED.