Policy 7230A - Department of Administration

annual basis. This review should be structured such that one
third of accounts per system are reviewed each year.
4.3. Session Management
The following are the Non-Mandatory Baselines that support the Session Management
section of the Default Security Requirements:
4.3.1. Configure Systems for Secure Access
Agencies should ensure that systems are configured in such a way as to
support and enhance user access and permission restrictions:
4.3.1.a System Use Notification
• System use notifications should, at a minimum, specify that:
o Access is to a system owned by the organization.
o Access to and actions within the system are monitored,
recorded and may be audited.
o Unauthorized access is not permitted and is a criminal
offence.
o System use implies consent to these strictures.
4.3.1.b System Lock-Out
• Session lock resulting from authentication failure should occur
after five failed authentication attempts that occur within a
fifteen minute time period and should last for a minimum of
30 minutes.
4.3.1.c Session Lock and Termination
• Session lock should apply only to sessions that are initiated by
end users and not to system-initiated sessions. Session lockout
should occur after twenty minutes of inactivity.
• Session termination should apply only to sessions that are
initiated by end users and to system-initiated sessions. Session
termination should occur after twenty minutes of inactivity.
4.3.2. Configure Systems for Secure Communication
Agencies should limit the potential of security threats bridging systems and of
data leaking inadvertently by restricting inter-system communications:
4.3.2.a Intra and Inter-System Authentication
• Systems that have very low or low risk impact should be
identified by TCP/IP address.
• Systems that have moderate risk impact should be identified
by MAC and TCP/IP address.
• Systems that have high risk impact should be identified by
TCP/IP and MAC address as well as either 802.1x or Radius
authentication.
8