Locking vendor accounts after their job is over, locking inactive admin accounts at 90 days
Posted by greggles on October 11, 2015 at 2:05pm
Old and unused accounts with admin access are a common entry point for attacks. They often have weaker passwords than a current account and the passwords are not being rotated making the accounts easier to brute-force over a long period.
There are two policies that create a solution to this problem:
- If a vendor will be doing work for a known amount of time, set their account to expire (be made inactive) on the date their work is likely to be done. This is required by PCI DSS 3.1 section 8.1.4.
Subscribe with RSS 