Contact us anytime to know more — Kuldeep K., Founder & CEO CISIN
Resources include directories, files, and devices. The daily routine of a systems administrator includes controlling access to resources. Often, the control is done by groups. The groups are logical constructs that can be used for grouping user accounts to achieve a common goal.
If an organization has several system administrators, for example, all of them can be placed into one group. This group will then have access to essential system resources. Groups can be used to manage resources and access in this way. In the following sections, we will discuss user accounts and groupings more.
Way to Manage User Accounts
As stated above, user accounts are the means by which an individual can be identified and authenticated in the system. Several components make up user accounts. The username is the first component. Next, the password and access control information are displayed. These sections will explore these components in greater detail.
The Username
The system uses the username to answer the question, "Who are you?" The usernames must meet one requirement. They must be unique. Each user must, therefore, have a unique username. It is important to decide (in advance) how you will create usernames. You may be forced to create new accounts every time someone requests one. It would be best if you created a naming scheme for your accounts.
Name Conventions
You can save yourself time and effort by creating a standard for usernames. You can save yourself a lot of trouble by making a naming convention for usernames. You can keep your naming convention simple or include a detailed description. Your naming convention will depend on several factors:
- Your organization's size
- Your organization's structure
- Your organization's nature
It is essential to consider the size of your organization because it will determine how many users you can support with your naming convention. A very small organization may be able for everyone to use their first names. This naming convention wouldn't work for a larger organization.
The structure of an organization can also influence the best naming convention. It may be appropriate for organizations with a clearly defined system to incorporate elements of this structure into the naming convention. For example, you could include your organization's departmental codes as part of each username.
Some naming conventions may be more appropriate for your organization than others, depending on its overall nature. An organization that deals with highly classified data might choose a naming convention that does away with any personally identifiable ties between the individual and their name. Maggie McOmie might have a username of LUH3417 in such an organization.
Other organizations have adopted a variety of naming conventions.
- First name (John, Paul, George, etc.)
- Last name (smith, jones brown etc.
- First initial followed by the last name (jsmith phones gbrown etc.).
- Last name followed by the department code (smith029, jones454, Brown191, etc.).
Dealing With Collisions
No matter what you do, collisions will happen. In your naming convention, you must account for collisions. This can be achieved in several ways:
- Add sequence numbers to the colliding user (smith, Smith1, Smith2, etc.).
- Add user-specific information to the colliding usernames (smith, Esmith, Eksmith, etc.).
- Addition of organizational communication (Smith, smith029, smith454, smith455, etc.).
Any naming convention must include a method to resolve collisions. Determining an individual's username from outside the organization is more challenging. The downside to most naming conventions is that they can make it more likely for emails to be misdirected.
Read More: What Should You Know About Custom Software Development?
How To Deal With Name Changes
Your organization will inevitably have to deal with name changes if it uses a naming scheme based on the user's name. A user may request a username change even if their name doesn't change. Users may request a change in username for various reasons, including not liking the current username or being a senior employee and using their influence to get a more "appropriate" username.
There are several things to consider when changing your username, no matter the reason:
- Change on all systems affected
- Any underlying user identification should remain constant
- Change ownership of all files and other resources specific to users (if needed).
- Email-related issues
It is crucial to propagate the new username across all systems where the old username was used. If you don't, any system function that relies upon the username could work on one system but not another. Specific operating systems employ access control techniques that are based on usernames. These systems are especially vulnerable to issues arising from a username change.
Most operating systems rely on some form of user security identification for user-specific processing. Try to maintain the same identification number between the new and previous username. This will minimize problems that may arise from a username change. If you fail to do this, the user will likely be unable to access any files or other resources they previously owned using their original username.
It is essential to update the ownership of all files and resources specific to a user if the user identification must be updated. It can be a very error-prone procedure because something always seems to be forgotten in some corner of the system. Email is probably where a username change can be the most challenging. Unless you prevent it, emails to the previous username won't be delivered to your new username.
The impact of a username change on email is multi-dimensional. A username change is the most basic form of a username change. It means that the correct username has been changed. This might not appear to be a big deal at first. Just inform everyone within your organization about the change. What about those outside your organization who have sent the email to this person? How can they be notified of this? What about internal and external mailing lists? How do you update them?
These questions are not easy to answer. It may be best to create an email alias so that any email sent to the previous username will automatically be forwarded to your new username. You can ask the user to inform anyone emailing about their new username. Over time, the alias will be used less and less. Eventually, the pseudonym may be removed. The only way to ensure that emails reach the right person is by using aliases.
Important
Take the necessary steps to prevent the old username from being reused. The email service may be affected if a new username is sent to a user. It depends on the way your operating system implements email delivery, but two of the most common symptoms are:
- The original user is the only one who receives emails.
- The user stops receiving emails, and all emails are sent to the new user.
Passwords
If the username answers the question, "Who are you?" The password is the answer to the inevitable demand that follows. A password is a way to prove the authenticity of the person claiming to be the person indicated by the username. The effectiveness of an authentication scheme based on a password depends heavily on the password's characteristics:
- The secret password
- The password's resistance to guessing
- The password's resistance to brute force attacks
Strong passwords address all of these concerns, while Weak passwords do not handle any or all of them. Strong passwords are essential for the security and safety of an organization. They are less likely to get discovered or guessed. Two options are available to enforce strong passwords.
- The system administrator creates passwords for each user.
- System administrators can allow users to create passwords while ensuring they are strong enough.
Creating strong passwords for each user is essential, but this task becomes more difficult as an organization grows. This increases the likelihood that users will write down their passwords. Most system administrators hesitate to allow their users to create passwords. A good system administrator will take steps to ensure that the passwords used are strong.
Every system administrator should firmly believe in the need to keep passwords secret. This is a point that many users miss. Many users don't even know the difference between usernames and passwords. It is essential to educate your users about this unfortunate reality. Passwords must be as hard to guess as possible. Strong passwords are ones that even an attacker who knows the user very well cannot imagine.
The brute force attack systematically attempts to find the password by trying every combination of characters (typically using a password cracker program). The number of possible passwords to be tested should be significant to force the attacker to spend a lot of time trying to find the password. The following section will explore solid and weak passwords in detail.
Weak Passwords
A weak password will fail one of the three tests.
- Secrets are kept secret
- It isn't easy to guess
- It can withstand a brute-force attack
These sections will show you how weak passwords are.
Short Passwords
A short password is weak and more vulnerable to a brute force attack. Consider the table below, which shows the number of possible passwords that will be tested during a brute-force attack. The passwords will be assumed only to contain lowercase letters.
The Length Of The Password Compared To The Number Of Possible Passwords
The number of passwords that can be generated increases as the length of the password increases.
Warning
This table does not recommend that six-digit passwords are sufficient for security management. The longer the password, the better.
Limited Character Set
The number of characters in a password can significantly impact an attacker's ability to perform a brute-force attack. What if, for example, we used numbers instead of the 26 characters that are allowed in a password with only lowercase letters? This would enable each character to be chosen from 36 different characters instead of only one. This increases the number of possible passwords for a six-character code from 308,915,776 up to 2,176,782,336.
It is not over yet. If we include mixed-case alphanumeric (for operating systems that support this), the number of possible six-character passwords rises to 56,800.235.584. The number of passwords increases further when you add other characters, such as punctuation. This makes a brute force attack much more difficult.
It is important to remember that not all attacks on a password are brute-force attacks. The following sections will discuss other factors that make up a weak password.
Words That Are Easily Recognized
Most attacks on passwords are motivated by the fact that most people prefer passwords they remember. For most people, the most straightforward passwords to remember include words. Most password attacks use dictionary-based techniques. The attacker searches through dictionaries to try and find the password.
Personal Information
Dictionary-based attacks may or may not pick up passwords containing personal data (such as the name, birth date, pet's identification number, or the name of a loved person). Suppose the attacker is familiar with you (or has enough motivation to research your personal life). In that case, they may be able to guess your password easily.
Many password-crackers include other information, such as dates, common names, and dictionaries. Even if an attacker doesn't know your dog's name, they can still use a password cracker to find your password, "mydogisgracie."
Simple Word Tricks
Reversing the order of characters in any of the previously discussed information will not strengthen a weak password. Most password crackers use these tricks. Some of these tricks include substituting numbers for letters in words. Here are some examples.
Use The Same Password For Multiple Systems
Using the same password for multiple computers is not a good idea, even if it is vital. If the systems are configured with a central authentication system, then there is little that can be done. But in all other cases, using different passwords for each design is best.
On Paper: Passwords
A weak password can be created by writing it down. You no longer need to worry about secrecy but rather physical security. It is not a good idea to write down your password.
Some organizations, however, have a legitimate requirement for passwords that are written down. Some organizations, for example, use written passwords to help recover after losing key personnel. The paper containing passwords in these cases is kept in a physically secure location, and multiple people must cooperate to gain access. Vaults and safe deposit boxes with multiple locks are commonly used.
No matter how safely the passwords are stored, any organization that uses this method to store passwords in an emergency should be aware of the risk when passwords are written down. This is especially true if the passwords (and their location) are known to everyone.
Written passwords, which are usually not part of recovery plans and not kept in vaults, are instead passwords that are used by ordinary users and stored in:
- In a desk or file drawer (locked/unlocked)
- Below a keyboard
- A wallet
- Tape on the monitor's side
These are not the proper locations to write a password.
Want More Information About Our Services? Talk to Our Consultants!
How Do You Manage Access Rights And User Accounts?
Any system administrator must manage user accounts and their access rights. This involves creating, editing, and deleting user accounts, assigning roles and permissions to them, and enforcing the security policies. This article will teach you some best practices to manage user accounts and rights within a system administrator context.
Define User Roles
Determining user roles is the first step in managing user accounts and rights of access. User roles are groups that have similar functions and responsibilities within the system. You may, for example, have different user roles, such as manager, administrator, employee, guest, or customer. You can streamline the process of assigning or revoking rights by defining roles for users. You can enforce role-based control policies (RBAC), ensuring that users have only the minimal access needed for their tasks.
Implement Password Policies
Implementing password policies is another critical step in managing user accounts and rights. Password policies enforce that users create and use strong, secure passwords. You may, for example, have password policies that specify a minimum password length, complexity, and expiration date. Implementing password policies can help you prevent unauthorized access and brute-force attacks. Password managers, encryption, and multifactor authentication can improve password security.
Audit User Activity
Auditing user activity is the third step to managing user accounts and rights. Auditing user activities is recording and monitoring user actions and events in the system. Auditing user activity can include, for example, login attempts, file changes, system errors, and configuration changes. Auditing user activities lets you detect security incidents, compliance issues, and performance problems. Audit logs, alerts, and reports can be used to analyze trends and user behavior.
Automate User Management
Automating user management is the fourth step to managing user accounts and rights. Automation of user management involves using scripts, applications, and tools to automate user management tasks or perform them with minimal human involvement. You can automate tasks like creating, updating, and deleting users. You can also provision and deprovision access rights. Automating user management can help you save time, reduce mistakes, and increase efficiency.
Users Should Be Educated
The fifth step to managing user accounts is to educate the users. Informing and training users on the best practices, policies, and procedures for using the system and protecting their access rights and accounts is called educating users. You can inform users of the importance of passwords, the dangers of phishing and malware, and the reporting and resolution procedures, etc. You can increase awareness, compliance, and satisfaction by educating your users.
Update User Accounts And Rights To Access Them
Reviewing and updating these regularly is the sixth and final step to managing user accounts. Reviewing and editing user accounts and access rights involves checking and changing the settings and status of users, as well as their access rights, following the current system needs. You may update and review user accounts when user roles, permissions, or responsibilities change. This can also happen when security and performance are updated, and users provide feedback. You can maintain accuracy, efficiency, and safety by reviewing and updating access rights and user accounts.
Access Control Information
Access control information is also stored in user accounts along with the username and password. The data is presented in different ways depending on the operating system. The types of information that are often included include:
- Identification of users across the system
- Identification of groups across the system
- Lists of other groups/capabilities that the user belongs to
- All user-created resources and files will be subject to a default access policy
In some organizations, the access control information of a user may not need to be changed. This is often the case when it comes to standalone personal workstations. Some organizations, especially those that use network-wide resources shared among different groups, require that the access control information of a user be modified extensively.
How much your organization relies on the access control features of your operating system will determine how much work is required to maintain access control information for your users. It isn't a bad idea to rely heavily on these features; it may be impossible to avoid. However, this can mean you must spend more time maintaining your system, and each user account may have more potential for misconfiguration.
Suppose your organization needs this type of environment. In that case, it is essential to document the exact steps required to create and configure a user. If there are multiple types of accounts, it is necessary to write them all (creating an operations user account or a finance user account).
Want More Information About Our Services? Talk to Our Consultants!
Conclusion
The access management process is not complete without a review of user access. This can reduce the hire cybersecurity services for your organization by removing unnecessary access to sensitive information and limiting user privileges. You can audit access more quickly and efficiently by using dedicated tools for reviewing user access.
