bluesteens
commented
1 year ago suggested rewording of NFR001 Conformance Criteria by C Stöcker:
Authentication
- Information Systems and devices SHALL have appropriate authentication mechanisms to authenticate human and system users.
- Human user authentication SHALL have 2FA.
- Systems user authentication SHALL have ... [tbc]
- Authentication credentials transmitted during login are encrypted or hashed.
- Authentication credentials are not hard-coded and allow rotation
Authorization
- Access authorization SHALL follow an authorization role model where:
- Access permissions or entitlements are assigned to system roles and system roles to user accounts.
- System roles are designed to enable a human or system user to perform only tasks or functions on a system in line with the user’s job role (or system function, e.g. VRS system authorisation) in the business process.
- The provisioning of system roles to human or system user accounts and permissions or entitlements to system roles is not hardcoded, and so is dynamic (changeable) over time.
- Administrator roles are set up considering segregation of duties, and responsibilities are clearly identified.
Steering summary: Proposal to review the wording and intent regarding the provision of 2FA, as it is unclear whether it is an obligation or optional.
observation:
language definition:
Issue: It is unclear whether SHALL or SHOULD applies to the 2FA/MFA requirement.
Suggestion: If SHOULD is the intention, rephrase 4.3.1 Wallet User Management as follows: "This process SHOULD include secure provisioning of 2FA or MFA access credentials to a given user."