Security/Fundamentals
The goal of this document is to detail the rationales behind why various technologies and processes are encouraged or discouraged. Updates to this page should be submitted to the source repository on github. Changes are detailed in the commit history. |
Rationales
Topic | Rationale |
---|---|
Shared passwords are passwords or/and accounts that more than one person knows or has access to. They're discouraged because:
single shared account across multiple systems at the same time.
| |
§ Decentralized user account management
|
Decentralized user account management refers to user account management which is not driven by the source of truth for the user's account. Examples of this are:
This practice is discouraged because:
|
§ Multi-factor Authentication
|
Multi-factor authentication (MFA) is a security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity for a login or other transaction.
Requiring the use of MFA for internet accessible endpoints is encouraged because by requiring not only something the user knows (a knowledge factor like a memorized password) but also something that the user has (a possession factor like a smartcard, yubikey or mobile phone) the field of threat actors that could compromise the account is reduced to actors with physical access to the user. In cases where the possession factor is digital (a secret stored in your mobile phone) instead of physical (a smartcard or yubikey), the effect of MFA is not to reduce the field of threat actors to only those that have physical access to the user, because a secret can be remotely copied off of a compromised mobile phone. Instead, in this case, the possession factor merely makes it more difficult for the threat actor since they now need to brute force/guess your password and compromise your mobile phone. This is, however, still possible to do entirely from a remote location. In particular, storing both first on second factor on the same device (for example: mobile phone) is strongly discouraged. |
§ Network Security Monitoring
|
Network Security Monitoring (NSM) is the practice of monitoring raw network traffic in order to detect intrusions or abnormal behavior. The use of NSM is encouraged because it can:
|