Threat Actors:   

Identification of users is a prerequisite for granting access to resources and prevents unauthorized individuals or processes from accessing the system, while identification and authentication of users is the basis for many types of access control and user accountability. Without this accountability threat actors could compromise a user account and perform actions that may be difficult to detect, as there would be no identifiers attributed to the compromised account.

·  Service or group accounts used by the organization

·  Policy or procedures on method(s) used to uniquely identify and authenticate users.

·  Organizational procedures to remove access to service or group accounts when an individual terminates or due to change in job responsibilities e.g., an individual is transferred to another business unit.

Threat Actors:   

Poor authentication practices can lead to compromise. Using weak passwords with only single-factor authentication is a dangerous security practice and could lead to compromise with the use of password crackers and brute-force techniques. Implementing a stronger multi-factor identification mandate is preferred - requiring two forms of authentication for access.

·  An account provision process to examine identified methods of authentication. 

·  The use of unique accounts for new employees and contractors

·  The use and assignment of initial passwords

·  A password reset function for initial use

·  The requirement for password complexity, such as 12 characters, a mix of upper and lower case letters, number, and special characters.