KSI Example

The OSCAL Foundation's FedRAMP TFG elected to focus on [KSI-IAM-AAM] Identity and Access Management: Automated Account Management.

This is an example of how KSIs could be implemented in OSCAL. It does not necessary reflect exactly what should be collected or how.

KSI-IAM-AAM

The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation.

The 
 - lifecycle and
    - privileges of
 - all accounts, roles, and groups 
 - are securely managed 
   - using automation.

Related SP 800-53 Controls: AC-02 (02), AC-02 (03), AC-02 (13), AC-06 (07), IA-04 (04), IA-12, IA-12 (02), IA-12 (03), IA-12 (05)

Subjects

• Identity and Access Management (IAM) Process:
  • Document
  • Automated Workflow

Evidence

• For EVERY [ account (human and machine) | role | group ] , process artifacts (logs?) exist for that account's:

  • creation
  • privlige modification (requires some kind of manager approval)
  • disablement; and
  • deletion.

• Creation is triggered by an appropriate event:

• privilege escalation is triggered by an appropriate event

• privilege reduction is triggered by an appropriate event

• disablement is triggered by an appropriate event (offboarding, lack of use)

• deletion is triggered by an appropriate event

Appropriate Triggers Might Include

• external process (onboarding, offboarding, contractor onboarding)
• approval by authorized individual or role
• signing of some license agreement, RoB, etc.

Assumptions and Prerequisites

The automated workflow:

• produces logs for the following events:
  • account requests
  • approvals
  • privilege modificaiton (escalation and reduction)
  • disablement
• The logs are sent to a centralized logging capability
• The log transmission and storage has a high degree of integrity and non-repudiation
• Any identities pre-dating the workflow and logs are validated as accurate.

Correlation

• ICAM system access (accounts, groups and privliges)
• Centralized Logging access

Questions to Answer

• What does telemetry look like, vs point-in-time?

OSCAL High-Level Concept

NOTES