Page 134 - CISSO_Prep_ Guide

Identification of a user may be through a user ID, account or
customer number, badge, biometric value (in physical security
implementations), or other values such as an email address.
One of the most important elements of setting up a new user
account is to have a secure, reliable process to ensure that user
IDs are only given to the correct people and that the user IDs are
set up correctly.

Maintaining UserIDs

The maintenance of user IDs can be a tough challenge for many
administrators. It is often found that many user IDs that should
have been deleted or disabled still exist on an organization's
systems. These are user IDs that were given to employees,
contractors, consultants, auditors, and other authorized
personnel that no longer require that access. Of greatest
concerns are the user IDs that have high-level privileged access.
Many other user IDs may exist that are not required either, but
they belong to customers and are low-level ids that do not pose a
serious risk to the organization. When an employee or another
person no longer requires access to a system, their user IDs
should be disabled or removed. Leaving user IDs on the system
may pose a risk since they could be used by another person or
attacker.

Authentication
Authentication is the validation or verification of the
identification offered by the user. An entity claims whom they
are by offering an ID and that they are allowed on a system
based on that ID. The next step is to verify that it is the correct