Management of Special Accounts and Privileges
Certification criterion
Accounts and privileges used for special purposes, such as information system management and the management of personal information and important information, shall be granted to the minimum extent and shall be separately identified and controlled.
Key checkpoints
- Are formal privilege application and approval procedures established and implemented so that special privileges, such as administrator privileges, are granted only to the minimum number of personnel?
- Are control procedures, such as identifying accounts and privileges granted for special purposes and managing them in a separate list, established and implemented?
Detailed explanation
Formal privilege application and approval procedures shall be established and implemented so that special privileges, such as those of administrators, are granted only to the minimum number of personnel.
-
Define the types of accounts and privileges used for special purposes, such as information system management and the management of personal information and important information
※ Special privileges (examples)
- Administrator privileges (top-level privileges such as Root, Administrator, admin, sys, system, sa)
- Privileges granted to execute batch programs
- Security system administrator privileges
- Privileges to create accounts and set access rights
-
Establish and implement a "procedure for issuing/changing/revoking special accounts/privileges" so that, when special accounts and privileges are needed, application and approval are carried out in accordance with a formal procedure
-
Apply stricter criteria than the issuance procedure for general user accounts/privileges (such as approval by an executive or the security officer) so that special accounts/privileges are granted only to the minimum number of personnel who perform the relevant tasks
Control procedures, such as identifying accounts and privileges granted for special purposes and managing them in a separate list, shall be established and implemented.
- Prepare and manage a list of holders of special privileges
- Establish and implement control procedures for holders of special privileges, such as minimizing exceptions and strengthening monitoring
- Apply a procedure whereby special privileges granted to external parties, such as for information system maintenance, are created only when necessary and are immediately deleted or suspended once the work is completed
- Regularly review the status of holders of special privileges and keep the list up to date
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 5 (Management of Access Rights)
Evidence (examples)
- Guidelines related to special privileges
- Records of special privilege applications/approvals
- List of holders of special privileges
- Contents of special privilege reviews
Nonconformity examples
- When the approval history for granting administrator and special privileges for information systems and personal information processing systems cannot be verified in the system or in documents, or when the approval history and the special privilege records do not match each other
- When internal regulations require that personal information administrators and holders of special privileges be prepared and managed in a list, but this is not prepared/managed, or when some special privileges, such as those of security system administrators, are not identified/managed
- When a special maintenance account, used by a maintenance provider who visits once per quarter to maintain information systems and personal information processing systems, is left activated at all times without any limit on the period of use
- When the use of administrator and special privileges is not reviewed periodically, so that some holders of special privileges continue to retain their existing administrator and special privileges even though their duties have changed