tools-only User Access and Password Management
Overview
This document outlines the comprehensive procedures for managing user access requests, password resets, account provisioning, and related security processes within the organization's IT environment.
Purpose
- Ensure secure and efficient user access management
- Maintain compliance with security policies and regulations
- Provide timely access provisioning and password support
- Protect organizational resources from unauthorized access
Access Management Framework
Access Control Principles
- Principle of Least Privilege: Users receive minimum access required for job functions
- Role-Based Access Control (RBAC): Access based on organizational roles and responsibilities
- Segregation of Duties: Critical functions require multiple approvals
- Regular Access Reviews: Periodic verification of user access requirements
Access Categories
| Access Type | Description | Approval Required | Review Frequency |
|---|---|---|---|
| Standard User | Basic email, file shares, common applications | Manager | Annual |
| Power User | Additional applications, local admin rights | Manager + IT | Bi-annual |
| Privileged User | Administrative access, sensitive systems | Manager + Security | Quarterly |
| External User | Contractors, vendors, temporary access | Sponsor + Security | Monthly |
Password Management Procedures
Password Reset Process
Self-Service Password Reset
- User Access: Navigate to self-service portal
- Identity Verification: Answer security questions or use mobile authentication
- Password Creation: Follow password complexity requirements
- Confirmation: Receive email confirmation of successful reset
- Next Login: Use new password for next system access
Assisted Password Reset
- User Request: Submit ticket or call service desk
- Identity Verification:
- Full name and employee ID
- Department and manager name
- Last known password (partial)
- Personal verification questions
- Reset Execution: Generate temporary password
- Communication: Provide password via secure method
- Force Change: Require password change at next login
Password Policy Enforcement
Password Requirements
- Minimum Length: 12 characters
- Complexity: Upper and lowercase letters, numbers, special characters
- History: Cannot reuse last 12 passwords
- Expiration: 90 days for standard users, 60 days for privileged users
- Account Lockout: 5 failed attempts, 30-minute lockout period
Password Security Guidelines
- Use unique passwords for each system
- Enable multi-factor authentication where available
- Store passwords in approved password managers
- Report suspected password compromise immediately
- Avoid sharing passwords or writing them down
Account Provisioning Process
New User Account Creation
Request Initiation
- HR Notification: New hire information from HR system
- Manager Request: Department manager submits access request
- Required Information:
- Employee personal information
- Job title and department
- Start date and duration (if temporary)
- Required systems and access levels
- Manager approval and business justification
Approval Workflow
| Request Type | Primary Approver | Secondary Approver | Security Review |
|---|---|---|---|
| Standard Access | Direct Manager | Department Head | Automatic |
| Elevated Access | Direct Manager | IT Manager | Security Team |
| Administrative Access | Department Head | IT Director | CISO |
| External Access | Business Sponsor | Security Manager | Mandatory |
Account Creation Process
- Identity Verification: Verify employee information with HR
- Account Creation: Create user accounts in Active Directory
- Group Membership: Add to appropriate security groups
- Application Access: Provision access to required applications
- Equipment Assignment: Assign devices and assign them to user
- Welcome Package: Provide login credentials and getting started guide
Account Modification Process
Access Change Requests
- Role Change: Manager submits request for role-based access changes
- Department Transfer: HR triggers access review and modification
- Temporary Access: Time-limited access for special projects
- Access Removal: Remove unnecessary permissions
Change Implementation
- Request Validation: Verify change request and business justification
- Impact Assessment: Evaluate access change implications
- Approval Process: Follow appropriate approval workflow
- Implementation: Apply access changes to all relevant systems
- Verification: Confirm changes are applied correctly
- Documentation: Update user access records
Account Deactivation Process
Termination Triggers
- Employee Termination: HR notification of employment end
- Extended Leave: Temporary account suspension for leave of absence
- Security Incident: Immediate account suspension for security reasons
- Contract Expiration: Automatic deactivation for temporary accounts
Deactivation Workflow
Immediate Actions (within 2 hours):
- Disable Active Directory account
- Revoke VPN and remote access
- Suspend email account
- Disable multi-factor authentication tokens
Extended Actions (within 24 hours):
- Remove from all security groups
- Disable application-specific accounts
- Transfer or backup user data as required
- Collect and inventory assigned equipment
Final Actions (within 30 days):
- Archive user data per retention policy
- Delete temporary files and cache
- Update documentation and asset records
- Complete termination checklist
Multi-Factor Authentication (MFA)
MFA Implementation
- Scope: Required for all users accessing corporate resources
- Methods: Mobile app, SMS, hardware tokens, biometric authentication
- Exceptions: Emergency access procedures for MFA device loss
- Enforcement: Conditional access policies based on user risk
MFA Support Procedures
Device Setup and Registration
- Initial Setup: Guide users through MFA device enrollment
- Backup Codes: Provide emergency backup authentication codes
- Multiple Devices: Allow registration of multiple authentication devices
- Verification: Test MFA functionality before enabling enforcement
MFA Troubleshooting
- Device Loss: Temporary disable MFA with manager approval
- Device Replacement: Re-enrollment process for new devices
- Sync Issues: Troubleshoot time synchronization problems
- App Problems: Reinstall and reconfigure authentication apps
Privileged Access Management
Administrative Account Management
- Separate Accounts: Dedicated administrative accounts for privileged tasks
- Naming Convention: Clear identification of administrative accounts
- Enhanced Monitoring: Detailed logging of all privileged account activities
- Regular Reviews: Quarterly review of administrative access requirements
Privileged Access Workflow
- Access Request: Submit request with business justification
- Risk Assessment: Evaluate security risks and mitigation measures
- Approval Process: Multi-level approval for high-risk access
- Time-Limited Access: Automatic expiration for temporary privileges
- Activity Monitoring: Real-time monitoring of privileged account usage
Service Desk Procedures
Common Access Requests
Password Reset (Priority: Medium)
- Response Time: 15 minutes
- Resolution Steps:
- Verify user identity
- Reset password in Active Directory
- Provide temporary password securely
- Require password change at next login
- Update ticket with resolution details
Account Unlock (Priority: High)
- Response Time: 10 minutes
- Resolution Steps:
- Verify user identity and account status
- Unlock account in Active Directory
- Verify account functionality
- Provide security awareness if needed
- Close ticket with resolution notes
Access Request (Priority: Medium)
- Response Time: 2 hours (after approval)
- Resolution Steps:
- Validate request completeness
- Route for appropriate approvals
- Implement access changes after approval
- Verify access functionality
- Notify user of access provisioning
Escalation Triggers
- Security Concerns: Suspicious access requests or account activities
- VIP Users: Executive or high-profile user access issues
- System Issues: Active Directory or authentication system problems
- Policy Violations: Requests that don't comply with access policies
Compliance and Auditing
Regulatory Requirements
- SOX: Financial system access controls and documentation
- HIPAA: Healthcare data access controls and audit trails
- GDPR: Data access controls and user consent management
- Industry Standards: ISO 27001, NIST frameworks compliance
Access Review Process
Regular Access Reviews
- Monthly: Privileged and administrative account reviews
- Quarterly: Department-level access reviews
- Annually: Comprehensive organization-wide access review
- Ad-hoc: Incident-driven and risk-based reviews
Review Documentation
- Access Inventory: Complete listing of user access rights
- Business Justification: Documentation of access requirements
- Approval Records: Audit trail of access approvals and changes
- Exception Reports: Identification and remediation of access anomalies
Security Monitoring
Access Monitoring Tools
- SIEM Integration: Security information and event management
- User Behavior Analytics: Anomaly detection for unusual access patterns
- Privileged Access Monitoring: Specialized tools for administrative accounts
- Real-time Alerts: Immediate notification of suspicious activities
Risk Indicators
- Failed Login Attempts: Multiple failed authentication attempts
- Unusual Access Patterns: Access from unusual locations or times
- Privilege Escalation: Unauthorized elevation of access rights
- Data Access Anomalies: Unusual data access or download patterns
Tools and Technologies
Identity Management Systems
- Active Directory: Primary directory service for user accounts
- Azure AD: Cloud-based identity and access management
- LDAP Integration: Integration with third-party applications
- Single Sign-On (SSO): Unified authentication across applications
Security Tools
- Privileged Access Management (PAM): CyberArk, BeyondTrust, or similar
- Identity Governance: SailPoint, Okta, or Microsoft Identity Manager
- Password Management: LastPass Enterprise, 1Password Business
- Multi-Factor Authentication: Microsoft Authenticator, RSA SecurID
Training and Awareness
User Training Topics
- Password Security: Best practices for password creation and management
- MFA Usage: How to setup and use multi-factor authentication
- Access Requests: Proper procedures for requesting system access
- Security Awareness: Recognizing and reporting security threats
Service Desk Training
- Identity Verification: Proper procedures for verifying user identity
- Security Policies: Understanding of organizational security policies
- Escalation Procedures: When and how to escalate security concerns
- Tool Proficiency: Effective use of identity management tools
Last Updated: September 2025 Document Owner: Identity and Access Management Team