Definitions

Information Technology and Security Definitions

Policy

It is the policy of OU that privileged access be managed with proper controls to mitigate the risk of malware infections, accidental errors, and service account compromises.

Procedures

Staff, Faculty, Students, Third Parties, or Contractors

All staff, faculty, students, third parties or contractors with administrator access on a university-owned device on the OU network must use operating system privilege elevation features. 

1. A user should be given only those privileges that are required to complete a task.  OU IT will provide a user account to be used for day-to-day functions (e.g., internet browsing and e-mail).
2. OU IT will provide a dedicated user account with local administrator permissions to be used when needed.
   1. Microsoft Windows users shall right-click and select RunAs to login with the dedicated administrator account, as needed to complete a task.
   2. Other users shall sudo or su programs, where appropriate, to login with the dedicated administrator account, as needed to complete a task.
   3. Accounts with privileged level access are not to be used to conduct day-to-day functions.

Account Management

1. Create Privileged and Service Accounts in accordance with the least privilege requirements in the OU Identity and Access Management Policy.
2. Follow the OU Password Policy.
3. Maintain a list(s) of individuals who have privileged access.  The list must be reviewed by a Data Owner in accordance with the OU Identity and Access Management Policy.  At a minimum, this list must include the following attributes:
   1. Data Owner: a senior University administrator accountable for the quality and maintenance of one or more Authoritative Sources of data relied upon for key University operations.
   2. Data Steward: named by a Data Owner to develop and implement rules and procedures needed to ensure data and security policies set by the Data Owner are enforced.
   3. Asset Administrator:  an individual with principal responsibility for: the installation, configuration, security, and ongoing maintenance of an asset (e.g., system administrator or network administrator). The Asset Administrator role is performed by University Personnel with a named Office of Information Technology or Departmental Information Technology job title.
   4. Purpose:  indicates the specific university mission the privileged accounts supports (e.g., University Mission - Operations: Includes administrative and technical functions, University Mission - Teaching / Learning: Includes faculty; classroom and computer lab functions, University Mission - Research: Includes research functions, University Mission - Healthcare: Includes clinical and patient care functions.
   5. Privileges Assigned:  indicates the roles or permissions granted to the account.
4. Store Enterprise and Domain Administrator credentials in an OU IT Privileged Account Vault.
5. Store Local Admin Account credentials in a user managed password vault.
6. Store Domain Privileged User Accounts in a user managed password vault.
7. Store Service Accounts in an OU IT Privileged Account Vault.
8. Store Application Admin in a user managed password vault.
9. Change the password for any shared administrator account under any of the following conditions:
   1. an individual, contractor, or vendor knowing the password leaves the department or completes their work.
   2. job duties change such that the individual no longer performs the functions requiring administrator access.

Least Privilege

The principle of least privilege is an important concept in computer security, promoting minimal user privileges on computers, based on users’ job duties. This helps reduce the “attack surface” of the computer by eliminating unnecessary privileges that can result in network exploits and computer compromises. The principle of least privilege can be applied by ordinarily operating without administrative rights.  Asset Administrators must implement the principles of least privilege.  

1. Administrator privileges may only be granted through a dedicated privileged account that is not used on a day-to-day basis for reading email or web browsing.
2. Deploy role-based access controls and group policies to prevent individuals from accessing information or services that are not required for the role.
3. Access to scripting tools (e.g., PowerShell, command prompt, wscript, cscript, etc.) should be limited to authorized privileged accounts.
4. Where possible, restrict access to administer devices by IP address (firewall access control lists, restrict by IP at the key level for SSH).

Separation of Duties

Separation of duties is one of the most basic ways to protect the integrity and security of OU data and IT Services.  Separation of duties is both an IT best practice and an audit and control standard that reduces the risk of malicious or inadvertent breach of system security, data integrity, or the disruption of normal business processes. Asset Administrators must configure systems to support the separation of duties.

1. Separate development, test, and production environments either logically or physically.
2. Development and production software, where possible, must run on different systems.
3. Users should use different passwords for production, test, and development systems.
4. Accounts should be approved by the data owner and subsequently created by a separate, independent system security administrator.
5. Access to system logs and system audits should be limited to system security analysts, and all such access should be reviewed by IT management.
6. Access to firewalls and other network security systems should be limited to the network security analysts, and all such access should be reviewed by IT management.

Multi-Factor Authentication

OU IT and DIT must manage privileged access:

1. Multi-Factor Authentication (MFA) is required.  If MFA is not technically feasible, an approved IT Security Exception Request is required.  Data Owners must review and approve exceptions and notify OU IT regarding changes to approved exceptions.

Privileged Access Logging

1. Log the use of privileged accounts in accordance with the OU System Logging Policy.  Examples of events to log include:
   1. The use of admin privileges (RunAs, sudo, etc.)
   2. Successful and failed admin login attempts or privilege escalation attempts
   3. Account lockout events
   4. Changes to privileged groups (e.g., addition a user to a privileged group)
   5. Actions of privileged account usage.