5.17 Authentication Information

Allocation and management of authentication information should be controlled by a management process, including advising personnel on the appropriate handling of authentication information.

To ensure that authentication of entities both internal and external are managed properly and to ensure that authentication failures are prevented.

Authentication management is an important practice for an organisation. One of the most effective methods of information security breaches is the circumvention of the authentication process. Therefore, it is crucial that organisation considers aspects such as:

• Non-guessable, unique password and personal identification numbers (PINs) generated automatically,
• Procedures to identify and verify the temporary and permanent authentication methods
• Authentication information is transferred to a secure location using a secure manner.
• Dodgy authentication devices and methods to be removed from the system

It is beneficial for the organisation to record the details of authentication methods in a well-structured document. Identifying the responsibilities of the users and all relevant authentication methods.