Omaerz: 9 revisions imported: Initial Upload of old pages from IDESG Wiki

2018-06-28T04:03:32Z

9 revisions imported: Initial Upload of old pages from IDESG Wiki

New page

''<< Back to [[Baseline_Functional_Requirements_v1.0|Baseline Functional Requirements Index]]''

== SECURE-1. SECURITY PRACTICES ==
Entities MUST apply appropriate and industry-accepted information security [[IDEF Glossary STANDARDS|STANDARDS]], guidelines, and practices to the systems that support their identity functions and services.

=== SUPPLEMENTAL GUIDANCE ===
Entities may satisfy this Requirement by confirming that they (a) have considered existing
information security standards, guidelines and practices relevant to their environment; (b) have
identified the specific sources of guidance that are appropriate for their operations, in light of the
information security risks they face; and (c) have implemented the portions of that guidance they
deemed appropriate.

This Requirement does not mandate which information security policies, procedures or technologies
an entity should or must use. However, some specific policies and technologies are the subject of
other, more specific items elsewhere in this Requirements set.

Entities must have risk-based countermeasures and safeguards in place to resist common threats to
identity solutions and identity data, including, for example, Session hijacking; Eavesdropping; Theft;
Man-in-the-middle; Online Guessing; Replay; Unauthorized copying or duplication; and Insider
Threats.

The security standards, guidelines, and practices employed in digital identity management services,
to govern the security of their networks, devices, solutions, and systems, must be both operational and
well documented. Please note the applicability of Requirement [[Interop Req 5|INTEROP-5 (DOCUMENTED PROCESSES)]]
regarding documentation and best practice [[Interop Best Practice G|INTEROP-BP-G (RECOMMENDED LEGAL COMPLIANCE)]]
regarding limitations imposed by laws. Please note the applicability of best practice [[Interop Best Practice F|INTEROP-BP-F
(RECOMMENDED FEDERATION COMPLIANCE)]] and Requirement [[Interop Req 6|INTEROP-6 (THIRD-PARTY
COMPLIANCE)]] regarding limitations arising from the involvement of [[IDEF Glossary THIRD PARTIES|THIRD-PARTIES]] such as
intermediaries, similar service providers, or [[IDEF Glossary FEDERATIONS|FEDERATIONS]].

=== REFERENCES ===
Potential candidates for adoption include: ISO/IEC 27000 series, PCI-DSS, NIST SP 800-53-4, CSA
CCM, COBIT v5, FFIEC (multiple documents), PCI-DSS, NISTIR 7621 R1 (draft)

=== APPLIES TO ACTIVITIES ===
[[IDEF Functional Model REGISTRATION|REGISTRATION]],
[[IDEF Functional Model CREDENTIALING|CREDENTIALING]],
[[IDEF Functional Model AUTHENTICATION|AUTHENTICATION]],
[[IDEF Functional Model AUTHORIZATION|AUTHORIZATION]],
[[IDEF Functional Model INTERMEDIATION|INTERMEDIATION]]

=== KEYWORDS ===
[[IDEF Keywords POLICIES|POLICIES]], [[IDEF Keywords RISK|RISK]], [[IDEF Keywords SECURITY|SECURITY]], [[IDEF Keywords OPEN-STANDARDS|OPEN-STANDARDS]]

----
----
Quick Links: [[SALS]] | [[Baseline Functional Requirements v1.0]] | [[Glossary]] |

----
----

Secure Req 1 - Revision history

Omaerz: 9 revisions imported: Initial Upload of old pages from IDESG Wiki