id: "IA-04(01)" title: "Prohibit Account Identifiers as Public Identifiers" family: "IA" family_name: "Identification and Authentication" sort_id: "ia-04.01" priority: "P1" implementation_level: "organization" parent: "IA-04" enhancement: True
Statement
Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.
Guidance
Prohibiting account identifiers as public identifiers applies to any publicly disclosed account identifier used for communication such as, electronic mail and instant messaging. Prohibiting the use of systems account identifiers that are the same as some public identifier, such as the individual identifier section of an electronic mail address, makes it more difficult for adversaries to guess user identifiers. Prohibiting account identifiers as public identifiers without the implementation of other supporting controls only complicates guessing of identifiers. Additional protections are required for authenticators and credentials to protect the account.
Assessment Objective
the use of system account identifiers that are the same as public identifiers is prohibited for individual accounts.
Identification and authentication policy
system security plan
procedures addressing identifier management
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
system/network administrators
Mechanisms supporting and/or implementing identifier management