SG-6: Account Management Guidelines

Guidelines (based on Foundational Requirements (FRs))

1. Identification and Authentication Control (FR-1) (SG-6)

   1. This will ensure that only authorized entities can interact with the system. For IPC context this requirement often starts at the firmware level. OnLogic’s BIOS does allow the set up for supervisors and user passwords.

      1. For authentication strength policies should enforce a minimum password character limit and should be replaced at X number of days

         1. Password complexity can be any number of these combinations: lowercase, uppercase, numbers, special symbols, and making the password itself case sensitive. (which means if you have a mix of uppercase and lowercase the prospective characters need the proper case in order to work)

         2. Multi-Factor Authentication (MFA) or 2-Factor Authentication (2FA) are optional if you want a more secure authentication method. They have a wide selection of implementation methods. Although MFA may be dependent on the operating system.

            1. They require the user to enter 2 or more verification methods to gain access to an account/system/application. It can be another password, a keypad pin, an answer to a security question, a verification code (randomly generated), a hardware key (yubikey), or a biometric value

   2. The system should have and support unique identifiers(UID) and accounts for all administrative accounts whether that's in the UEFI or OS. They may look like a readable alphanumeric username or a machine-readable system string

      1. In the event of an account lockout make sure there is a way to

         1. Verify the user is in fact the user (ie. verify employee number, verify with personal identifiers, etc)

         2. If it only affects one system/application/account is there a way to make account unlocking or resetting accessible by the end user

         3. Ensure only select user and/or admins only have the resources to do this

   3. The system should use a Trusted Platform Module (TPM 2.0) or Intel Trust Technology (PTT) for secure storage of cryptographic keys

2. Use Control (UC) (FR-2) (SG-6

   1. Least Privilege - this policy enforces the least privilege common practice, which in turn only allows authenticated users to only perform actions or tasks necessary and appropriate for their role. (same can be applied for access levels) This can also mean that restrictions are in place for BIOS settings to prevent any unauthorized changes to the boot order

      1. When setting up accounts make sure you always start with the minimum amount of privileges that users may need and make adjustments as needed. Good to also note that only admins should have the capability to do so

   2. User Roles- below will be a list of roles and the privileges that they may need

      1. System (super) Administrator - capabilities to do: provision & decommission environments, manage vendor subscriptions & licenses, deploy system code & API keys, execute hard data deletions, override data access restrictions, terminate live user sessions, bypass conditional access lockouts, & manage or revoke other administrative roles

      2. Network Administrator - access to: topology, routing, traffic incoming/outing & policies, firewalls, certificates, active/live monitoring, network related logs, & device management (depending on organization setup)

      3. Security Administrator - capabilities to do: assigning other roles, set restrictions, set password requirements per password strength, account provisioning & resets, group management, MFA, 2FA, & SSO authentication controls, data & integration methods, access to access logs, & access to security policies

      4. Standard User - (best to follow least privilege) reset own password, manage own MFA settings (should not be disabled), read and write access to appropriate files or directories, & any low level personalized changes

   3. Default account - any default account used by the product (for example, service accounts) and instructions for changing default account names and passwords

      1. "Out Of Box" Password Prompt

         1. The UEFI will ship from OnLogic with the UEFI in a “sealed” state. The next time the system’s UEFI Setup Menu is initiated by a user, it will prompt the user to set an admin password. After the password is set the UEFI will be in a “configured” state. This should not impact the boot process if the entering the UEFI is not initiated by a user.

      2. User Experience

         1. Users will only be prompted to set up the admin password when entering the UEFI for the first time. If entering the UEFI isn’t initiated by the user, the system will continue with its normal boot process.

         
      3. Password Minimum Requirements

         1. The UEFI password can be as simple or as complex as desired. But the minimum requirement will be support for at least 1 character up to 10 alphanumeric characters or special characters. Any password that doesn’t meet the following characteristics will warn the user of weak password strength:

            1. 8 characters minimum

            2. At least 1 uppercase letter

            3. At least 1 number

            4. At least 1 special character

      4. Factory Default & Password Persistence

         1. If the CMOS is cleared, or defaults are loaded from either a user-initiated event or battery failure. The system should fall back to the password that was initially set during the Out of Box setup phase.

      5. Factory Recovery

         1. For users that forget their password, an internal hardware-recovery mechanism such as a jumper will be implemented that when shorted, will put the system back into the Out of Box Experience state and will prompt the user to set up a password again.

      6. Provisioning with CLI Tools

         1. During the Testing Phase of manufacturing the Test Automation platform will generate and apply a “factory” password that is unique to the System Under Test (SUT). The UEFI will always fall back to this password in the event of a CMOS battery failure or user-initiated CMOS clear.

      7. UEFI Password Provisioning

         1. At the time of manufacturing the SUT will boot into OnLogic’s in-house test and imaging suite. During this phase the test suite will use a linux CLI tool to update the UEFI password. The password will be a randomly generated password that meets the following specifications:

            1. 8 characters

            2. At least 1 uppercase letter

            3. At least 1 number

            4. At least 1 special character

            5. Use strong Random Number Generation

         2. An example of the CLI tool being ran in Ubuntu: Once set the test suite will pair the password along with unique system identifiers (system serial, UUID) from the SMBIOS

         
      8. UEFI Password Storage

         1. The password and unique system identifiers will be stored on OnLogic servers behind proper access control. From there the password will be printed on the respective system’s label.