Summary

System access credentials must be unique for each actor.

Description

Unique credentials must tie specific access and actions to individually identified users. This promotes accountability by determining who performed a particular action or accessed certain data. In cases of unauthorized access or security incidents, unique credentials help identify the responsible user.

References

• CIS-5_2. Use unique passwords
• HIPAA-164_312_a_2_i. Unique user identification (required)
• PADSS-3_1_5. Payment application does not require or use any group, shared, or generic accounts and passwords
• PADSS-10_2_2. Unique authentication credential must be used for each customer environment
• HITRUST-01_q. User identification and authentication
• ISO27002-5_16. Identity management
• ISO27002-7_2. Physical entry controls
• IEC62443-IAC-1_2. Software process and device identification and authentication
• ISSAF-U_9. Web application SQL injections - Bypass user authentication
• NIST800171-5_1. Identify system users, processes acting on behalf of users, and devices
• PCI-8_2_1. Assign a unique ID before access to system components
• SIG-H_2. Access control
• SIG-U_1_9_18. Server security
• ISO27001-5_16. Identity management
• ISO27001-7_2. Physical entry controls
• NIST-PR_AA-01. Identities and credentials for authorized users, services, and hardware are managed by the organization

Weaknesses

• 035. Weak credential policy