Name: Ryan Smith Email: ryan7882003@yahoo.

com
Access is granted based on a unique user id and password combination Concurrent user logins are prohibited

Passwords: Protected and encrypted in password files or tables Are not produced as hardcopy in and unencrypted format Are required to be changed at regular intervals Are not disclosed to administrators Can be changed by users when required and on demand Are of 6 characters in length as a minimum and composed in a manner designed to prevent guessing Are rejected if they are simple or those used previously Are not recorded by the user in any format Terminal sessions are automatically terminated after 15 minutes Terminal are located in secure areas Accounts are locked out after 6 login failures Failed login count is remembered for at least 24 hours Accounts locked out have to be reset by the administrator Users access to application processes and data is restricted based on their roles All access levels requested have been authorised and recorded Users only belong to those groups that they are required to by their role Access to applications is logged. This lists the user id, processes and data accessed, terminal, session duration and time the application was accessed. This log is reviewed on a regular basis Review all user ids and investigate the number of users that have super user access to the system. Determine whether this number is appropriate and in line with their roles. Ensure that this level of access is monitored and logged. Review the level of auditing and the rational behind this. Ensure that the administrator account is not shared or used but equivalences have been set-up to individual accounts to allow for accountability to individuals.