id_and_assess_mgt.php

<?php
  include "header.php";
?>
<div class="container-fluid text-center">    
  <div class="row content">
    <div class="col-sm-2">
    </div>
    <div class="col-sm-8 text-left"> 
      <h1 style="text-align:center;">ID and Access Management</h1>
      <p style="text-align:center;">List of possible actions your organisation can take in other to improve its resilience to cryptojacking attack.</p>
      <hr>
      <ol>
        <li>
            <p>
                Implement a strong identity and access management (IAM) program to
                manage user identities and access privileges (Mohammed et al, 2018).
            </p>
        </li>
        <li>
            <p>
                Use strong authentication mechanisms, such as two-factor
                authentication, to ensure that only authorized users have access to
                critical resources (Ibrokhimov et al, 2019).
            </p>
        </li>
        <li>
            <p>
                Use role-based access controls (RBAC) to restrict access to
                resources based on the user's job function (Covington et al, 2000).
            </p>
        </li>
        <li>
            <p>
                Implement access controls to limit access to resources to only
                those users who require it (Sandhu et al, 1996).
            </p>
        </li>
        <li>
            <p>
                Implement password policies that require users to use strong
                passwords and change them regularly (Summers and Bosworth, 2004).
            </p>
        </li>
        <li>
            <p>
                Regularly review and update access privileges to ensure that they
                are appropriate for the user's job function (Sandhu et al, 1996).
            </p>
        </li>
        <li>
            <p>
                Implement user activity monitoring to detect and respond to
                unauthorized access attempts (Bejtlich, 2013).
            </p>
        </li>
        <li>
            <p>
                Implement network segmentation to isolate critical resources and
                restrict access to them (Klein, 2019).
            </p>
        </li>
        <li>
            <p>
                Use encryption to protect sensitive data in transit and at rest (Ghouse et al, 2019).
            </p>
        </li>
        <li>
            <p>
                Implement single sign-on (SSO) to streamline the login process and
                reduce the risk of password-based vulnerabilities (Chnitz, 2000).
            </p>
        </li>
        <li>
            <p>
                Implement multi-factor authentication (MFA) for remote access to
                critical resources (Ibrokhimov et al, 2019).
            </p>
        </li>
        <li>
            <p>
                Regularly audit and review user accounts to identify and remove
                inactive accounts and accounts with excessive privileges.
            </p>
        </li>
        <li>
            <p>
                Implement least privilege access to restrict user access to only
                the minimum required resources (Lang and Schreiner, 2012).
            </p>
        </li>
        <li>
            <p>
                Train employees on the importance of identity and access management
                and how to protect their user accounts from security threats (Alshaikh, 2020).
            </p>
        </li>
        <li>
        <p>
            Regularly test and audit the identity and access management system
            to identify potential vulnerabilities and weaknesses (Shah and Mehtre, 2015).
        </p>
    </li>
</ol>
<br />
<p>REFERENCES</p>
<p>
Alshaikh, M., 2020. Developing cybersecurity culture to influence employee behavior: A practice perspective. Computers & Security, 98, p.102003. [online] Available from: <a href='https://www.sciencedirect.com/science/article/pii/S0167404820302765'>https://www.sciencedirect.com/science/article/pii/S0167404820302765</a> [Accessed 1 4 2023]
</p>
<p>
Bejtlich, R., 2013. The practice of network security monitoring: understanding incident detection and response. No Starch Press.
</p>
<p>
Chinitz, J., 2000. Single sign-on: Is it really possible?. Inf. Secur. J. A Glob. Perspect., 9(3), pp.1-14. [online] Available from: <a href='https://www.tandfonline.com/doi/pdf/10.1201/1086/43310.9.3.20000708/31359.5'>https://www.tandfonline.com/doi/pdf/10.1201/1086/43310.9.3.20000708/31359.5</a> [Accessed 1 4 2023]
</p>
<p>
Covington, M.J., Moyer, M.J. and Ahamad, M., 2000. Generalized role-based access control for securing future applications. Georgia Institute of Technology. [online]. Available from: <a href='https://smartech.gatech.edu/handle/1853/6580'>https://smartech.gatech.edu/handle/1853/6580</a> [Accessed 1 4 2023]
</p>
<p>
Ghouse, M., Nene, M.J. and Vembuselvi, C., 2019, December. Data leakage prevention for data in transit using artificial intelligence and encryption techniques. In 2019 International Conference on Advances in Computing, Communication and Control (ICAC3) (pp. 1-6). IEEE.
</p>
<p>
Ibrokhimov, S., Hui, K.L., Al-Absi, A.A. and Sain, M., 2019, February. Multi-factor authentication in cyber physical system: A state of art survey. In 2019 21st international conference on advanced communication technology (ICACT) (pp. 279-284). IEEE. [online]. Available from: <a href='https://ieeexplore.ieee.org/abstract/document/8701960/'>https://ieeexplore.ieee.org/abstract/document/8701960/</a> [Accessed 1 4 2023]
</p>
<p>
Klein, D., 2019. Micro-segmentation: securing complex cloud environments. Network Security, 2019(3), pp.6-10.
</p>
<p>
Lang, U. and Schreiner, R., 2012, December. Implementing Least Privilege for Interconnected, Agile SOAs/Clouds. In ISSE (pp. 89-102).
</p>
<p>
Mohammed, K.H., Hassan, A. and Yusuf Mohammed, D., 2018. Identity and Access Management System: a Web-Based Approach for an Enterprise. [online]. Available from: <a href='http://oer.udusok.edu.ng/xmlui/handle/123456789/837'>http://oer.udusok.edu.ng/xmlui/handle/123456789/837</a> [Accessed 1 4 2023]
</p>
<p>
Sandhu, R.S., Coyne, E.J., Feinstein, H.L. and Youman, C.E., 1996. Role-based access control models. Computer, 29(2), pp.38-47. [online] Available from: <a href='https://ieeexplore.ieee.org/abstract/document/485845/'>https://ieeexplore.ieee.org/abstract/document/485845/</a> [Accessed 1 4 2023]
</p>
<p>
Shah, S. and Mehtre, B.M., 2015. An overview of vulnerability assessment and penetration testing techniques. Journal of Computer Virology and Hacking Techniques, 11, pp.27-49. [online] Available from: <a href='https://link.springer.com/article/10.1007/s11416-014-0231-x'>https://link.springer.com/article/10.1007/s11416-014-0231-x</a>
</p>
<p>
Summers, W.C. and Bosworth, E., 2004, January. Password policy: the good, the bad, and the ugly. In Proceedings of the winter international synposium on Information and communication technologies (pp. 1-6).
</p>
    </div>
    <div class="col-sm-2">
    </div>
  </div>
</div>
<?php 
  include "footer.php";
?>