How Identity and Access Management Supports FFIEC Authentication and Access Guidance

Password controls: prohibited password lists

Customers’ or users’ password choices are checked against databases of prohibited or weak passwords, including dictionary words, common passwords, and passwords associated with prior account or data breaches.

In practice: When someone picks a new password, the system rejects common and easily guessed passwords using a banned list the organization can extend, and checks against known breached passwords where that capability is in place.

Incorrect log-in attempts

Customers and users are locked out of accounts after a certain number of incorrect log-in attempts. Passwords are reset only after requiring strong authentication of the customer or user.

In practice: After several wrong passwords the account locks, and a password reset, whether self-service or through the help desk, requires a strong verification step first.

Enhanced authentication for credential reset

Enhanced authentication controls are applied to customer and user credential resets, such as sending an OTP to a pre-established communication device; using an authenticator application to provide an OTP; biometric voice recognition; enabling secure video chat features to confirm identity; and call-backs to a pre-established phone number.

In practice: A user resets a password through self-service with a second check, and the help desk uses a verification step before doing the same by phone.

Password controls: password strength

Policies and standards address password strength, such as password length, defined character combinations, and the use of passphrases. A passphrase is a series of words or other text that is generally longer than a traditional password.

In practice: The password standard sets a minimum length and allows long passphrases, and the directory and identity provider enforce the same settings wherever a password is created or changed.

Account maintenance controls

Enhanced authentication controls are applied for account maintenance activities (e.g., changes to physical or email address, password, contact information, or enrolled devices) performed or requested by customers or users.

In practice: When someone adds a new phone as a sign-in method or changes a recovery email address, the system asks for a second verification step first, and the change is logged.

Rate limit on log-in attempts

Rate limits, which represent the number of log-in submissions over a set timeframe, are applied for correct and incorrect log-in attempts from the same user or from different users from the same IP address. These controls limit the overall volume of authentication requests and can slow potential attacks.

In practice: The sign-in service slows or blocks repeated attempts against one account or from one network address, which slows automated guessing, and throttling events are logged.

Privileged users: dedicated devices or accounts

Privileged users have dedicated devices or accounts for all privileged or administrative activities. The dedicated devices cannot access the Internet.

In practice: An administrator has one everyday account for email and a separate administrative account used only for privileged work, and membership is reviewed.

Privileged users: dual controls

More than one privileged user at the financial institution must approve access to certain critical systems or certain requests for administrative changes.

In practice: A request for access to a critical system needs approval from at least two privileged users, set up as a multi-stage or multi-confirmer approval, before the elevation is granted.

Privileged users: enhanced authentication for system and software updates

Privileged users are re-authenticated with MFA prior to making system configuration changes, uploading or updating software or firmware, or executing significant system processes.

In practice: Before making a configuration change or installing a software update, the administrator is asked for MFA again at the admin portal.

Access approval policies

Policies establish approval and documentation standards for defining users’ authority to access financial institution information systems.

In practice: A user requests access in a workflow, the manager and application owner sign off, and the decision record is kept with the request.

Least privilege access provisioning

User access is limited to those information systems and resources related to the user’s job function or role.

In practice: A new employee receives the standard access for their role, and any extra access is an exception that gets reviewed.

Single sign-on capability

Single sign-on capability is established for users to allow access to multiple internal information systems with a single authentication solution.

In practice: Staff sign in once with single sign-on to reach internal applications, so strong authentication and monitoring happen at one point.

Service accounts

Service accounts are inventoried, and employees or departments are assigned responsibility for managing service accounts according to the financial institution’s password management and other security policies.

In practice: Service accounts are discovered and listed, each has a named owner, and the owner is responsible for managing its credentials under policy.

Automatic suspension or de-provisioning of user credentials

Policies and system controls are in place to de-provision or suspend access credentials after a certain period of account inactivity.

In practice: Accounts that sit unused for a set number of days are suspended automatically, and bringing one back follows a recorded re-enable process.

Notification to security administrators of change in user status

System administrators are informed in a timely manner of changes (e.g., alteration, removal, or suspension) to user status.

In practice: When HR records a transfer or termination, that change flows to connected systems and the affected system administrators are notified.

Risk assessment: identify users

Identify all users, including employees, service accounts, and users at third parties, that access financial institution information systems and data.

In practice: A single list shows every employee, service account and third-party user, each with an owner and a status such as active or terminated.

Risk assessment: high-risk user identification

Identify users who represent a high risk and for which enhanced authentication controls are warranted to protect information systems.

In practice: Administrators, remote users and people in sensitive roles are flagged from entitlement data so they receive stronger sign-in checks and more frequent review.

Layered security: least privilege provisioning

Layered security controls also can include assigning users’ access rights to information systems based on the principle of least privilege provisioning.

In practice: Roles are defined by job function, access is granted from the role, and managers review whether anyone holds more than the job needs.

Multi-factor authentication as part of layered security

When a financial institution management’s risk assessment indicates that single-factor authentication with layered security is inadequate, MFA or controls of equivalent strength as part of layered security can more effectively mitigate risks.

In practice: Where the risk assessment says a password alone is not enough, MFA is required for high-risk users and activities, and any accepted exception is documented.

Strong authentication for high-risk users

For high-risk users, strong authentication, such as MFA solutions using hardware and cryptographic factors, can mitigate risks associated with unauthorized access to information systems.

In practice: Administrators and other high-risk users sign in with hardware security keys or certificates instead of a text message code.

Call center and IT help desk authentication

Threat actors frequently have used social engineering and other techniques to deceive customer call center and IT help desk representatives into resetting passwords and other credentials, thereby granting threat actors access to information systems, user and customer accounts, or confidential information. A comprehensive risk assessment supports mitigation of this risk by identifying emerging threats, setting secure processes, employee training, and establishing effective controls for the customer call center and IT help desk operations.

In practice: Before the help desk resets a password, the caller completes a verification step, and the agent's check is recorded in the ticket.

Application timeouts

Customers and users are re-authenticated after a period of inactivity within a service or a system.

In practice: The application owner sets how long an idle session stays open, and identity policy sets how often users must sign in again, tuned to risk.

Endpoint and device authentication

Controls are in place to ensure only authorized devices can connect to the financial institution’s information systems, networks, or services.

In practice: The endpoint team manages the devices; identity policy checks that a laptop is registered and healthy, or holds a device certificate, before access.

Remote access software controls

Remote access software, which allows remote access to a user’s computer or enterprise network or system, is disabled if it is not being used. If remote access software is used, controls to mitigate threats can include placing a firewall in front of systems that use remote access software, having remote users connect with a virtual private network (VPN) or other secure channel, and implementing strong passwords with MFA. Software is updated periodically.

In practice: The network team runs the VPN or remote tool; identity makes it require MFA through the central identity provider for every remote session.

Transaction and audit logs

Transaction and audit logs monitor and record system and account activity to identify unauthorized activities, detect intrusions, reconstruct events, and promote customer and user accountability.

In practice: The logging team owns log retention; identity audit logs are kept and forwarded with consistent user identifiers so events can be traced.

Suspicious behavior monitoring

Processes monitor and report customer and user access, especially privileged and remote access users, for suspicious behavior.

In practice: Security operations watches for suspicious behavior, and identity risk detections for privileged and remote users are sent to that team.

Digital certificates

An inventory of machines that utilize digital certificates is maintained, and digital certificates and the underlying protocols are continually updated to address emerging threats.

In practice: The infrastructure team renews certificates; identity helps keep an inventory of machine and workload identities with owners and expiry dates.

Privileged users: change defaults

Default passwords and other credentials for privileged users or system, service, or administrative accounts are changed or disabled.

In practice: System owners run the platforms; identity places privileged and service accounts in a vault and rotates the default passwords that came with them.

Privileged users: log and alert

Systems are configured to log and alert when a privileged user account is added or removed and when unsuccessful logins or other anomalous behavior occurs.

In practice: The monitoring team receives alerts when someone is added to a privileged group or when privileged sign-ins fail or look unusual.

Privileged users: periodic review of activity

Staff independent of the privileged user’s organization or business unit is alerted of, and periodically reviews, privileged user activity for anomalous behavior.

In practice: Staff outside the administrator's own team review privileged session recordings from a queue; identity supplies the sessions and assigns the reviewers.

Privileged users: log access

Privileged user access is limited and defined between log-related privileges and other privileges. The logs of privileged user activity cannot be modified or deleted by the privileged user.

In practice: Administrators do not hold the rights to change or delete the logs of their own activity; log privileges sit in a separate role, and identity reviews who belongs to it.

Risk assessment: inventory of information systems

Inventory all information systems and their components, such as the hardware, operating systems, applications, infrastructure devices, APIs, data, and other assets, that require authentication and access controls. This inventory includes information systems provided by the financial institution’s third parties, such as cloud service providers.

In practice: The security team keeps the inventory of systems; identity adds the list of onboarded applications and which accounts connect to each one.

Risk assessment: controls assessment

Initially and periodically assess the design and effectiveness of access and authentication controls employed, including the availability of more advanced security options and configuration settings.

In practice: Management reviews how well sign-in and access controls are working, and identity reports where settings have drifted, against the institution's risk appetite.

Monitoring, logging and reporting

Monitoring, activity logging, and reporting processes and controls assist financial institution management in determining if attempted or realized unauthorized access to information systems and accounts has occurred.

In practice: Another team watches for unauthorized access; identity audit and detection events are kept and forwarded to that team's monitoring tools.

Customer-permissioned entities: credential and API-based authentication

A comprehensive risk management program includes an assessment of risks and effective mitigating controls for credential and API-based authentication when CPEs access a financial institution’s information systems and customer information.

In practice: The risk team assesses outside parties; identity keeps a list of the API clients and credentials those parties use and who is responsible for each.

Customer and user identity verification

Reliable identity verification methods can help reduce risk when establishing new customer accounts and when access is first requested for new users of information systems.

In practice: HR or the onboarding team verifies new users; identity records that proofing step in the lifecycle workflow, and the workflow asks for it again when someone seeks higher access.

Monitoring and reporting of unauthorized access by third parties

Processes are in place for third-party service providers to report, and the financial institution to log and monitor, unauthorized access to critical outsourced systems.

Network segmentation

Networks, systems, services, and data are physically and logically segmented based on the financial institution’s asset classification and risk assessment.

Transaction value, frequency and timing controls

Transaction controls, such as transaction value limits, restrictions on devices for adding payment recipients, limits on the number of transactions allowed per day, and allowable payment windows (i.e., permissible days and times during which transactions can be initiated) are applied for certain account and digital banking activities.

Email systems: patch management

Email systems are updated and patched periodically, and the email system vendor is monitored for email system end-of-life.