User Access and Authentication

User access and authentication verify who is using the Helpdesk before protected capabilities are made available.

Individual accounts

Each user should use their own account.

Shared accounts reduce auditability and make access removal more difficult.

Authentication credentials

Passwords and other authentication credentials must be protected and should never be placed in public documentation, tickets, or source code.

Sign-in problems

When a user cannot authenticate, verify identity and account status before changing security settings.

Session security

Users should sign out from shared devices and protect active sessions from unauthorized access.

Account lifecycle

Disable accounts promptly when a person no longer requires access.

Good practices

Use the strongest supported authentication controls appropriate to the organization. Review administrative accounts carefully and investigate unexpected authentication activity.