ASD Essentials for Enterprise IT PRO-13: Identity, credential and access management: find exposed secrets, remove default and unused accounts, secure secrets with MFA, phishing-resistant MFA, no legacy authentication, unique credentials

What does PRO-13 require?

Codebases, configuration files, file shares and collaboration platforms are scanned regularly for exposed keys, secrets and credentials. Default and unused accounts are found and disabled or removed on a routine basis, with any exception documented, justified, hardened and watched. Keys, secrets and tokens live in approved secure stores guarded by access controls and MFA. Users authenticate with phishing-resistant MFA whether they connect from inside the network or from untrusted, remote or risky locations. Legacy authentication protocols are switched off, or where that cannot yet happen, confined, monitored, compensated and given a dated decommissioning plan. Every user, machine, system and service account has credentials unique to that system or account, above all where privileges are high. Marked for every technical domain.