This chapter provides a comprehensive set of recommendations for strengthening security and authentication practices for administrator accounts:
Enrolling the administrator account for multifactor authentication is recommended to make it more difficult to compromise this account.
Ensure to control the administrator account with Privileged Account Management (PAM) solution. This provides compliance with the password rotation and complexity standards.
Configure account lockout policies to prevent brute force attacks. Always align with the identity corporate source of truth that helps maintain consistency in user identity management.
It is advisable to use named accounts instead of generic “admin” usernames for audit trail purposes.
Disable unnecessary accounts and keep unused accounts in a dormant state or remove if not needed. However, make sure to keep any audit historic data.
All accounts should be enrolled to at least one factor apart from the account password.
It is recommended to have strong passwords that are managed and rotated.
It is advised to have chains with more than one authentication mechanism and to be composed with methods that are a combination of the different authentication types “Something you have”, “Something you are”, and “Something you know”.
Use generic naming convention for chains rather than “Chain name: Method 1 + Method 2….” To avoid giving all the information about that methods are expected to successfully respond to the chain. This is to make it less predictable and defined to potential attackers.
Provide a generic naming convention for authentication chains that does not determine how many methods are in the chain (for example, TOTP Only) and does not outline the methods in the chain (for example, LDAP Password + Smartphone).
An example of a generic chain name could be “Fingerprint Authentication”.
We do not recommend any one authentication method in the authentication chain above all others. Best practice often dictates a blended configuration of various methods depending on the context which considers factors, such as trust, cost, user-friendliness, and information value.
Always register a minimum of two authentication methods per account, so there is always a substitute when one is lost or hacked and removed.
The Smartphone method is practical choice as a second factor for remote access. This can replace expensive hardware tokens with better security results.
It is advisable to disable Allow as first authentication method for methods, such as Email OTP, SMS OTP, and Voice OTP to reduce the risk of spamming and guessing OTP.
A practical approach to determine the authentication method that fits a specific use case or user group is by analyzing the associated business risk to the group in case of identity theft.
Segregating traffic based on authentication types or events simplifies the effort to troubleshoot and trace authentications.
It is advisable to only use valid SSL certificates for Smartphone authentication. Self-signed certificates are not recommended.
Request for membership of the Advanced Authentication administrative roles and groups should be well-motivated and follow an approval process to maintain security and control over access.
Consider stringent processes for testing, documentation, and promotion in any deployments of a multifactor environment to ensure the stability of each environment. The DEV (Development), QA (Quality Assurance) and PROD (Production) approach must be followed.
QA and PROD environments must be maintained by an environment “Gate Keeper” who has the role to vet the deployment and ensure that it verifies the naming conventions, standard best practices, documentation and all overlapping use cases are considered in each deployment.
Change or remove default chains attached to the events, especially the out-of-box events. This improves the overall security of the deployment.
Consider having the backup of local administrative account to allow for application recovery in case there is a disconnect to the Corporate Directory. This account should follow a very strong password strategies and be enrolled for multifactor.
Always use groups associated to the corporate directory in order to manage the level of access for different users (enrolled users, application administrators, and so on).
Perform periodic access reviews on the associated corporate directory groups to ensure that only valid users have the correct access particularly to the group that can perform administrative functions.
Prepare for off-line use of laptops and other devices that may have network coverage challenges. Consider authentication mechanisms that support such use cases.
Be aware of man-in-the-middle attack. Avoid using the same data channel of delivery of the different 2FA.