A.5.17 Authentication Information
1. Objective and Management Process
anDREa controls the allocation, issuance, and ongoing management of authentication information through a structured management process. This framework satisfies ISO/IEC 27001 Annex A.5.17 by ensuring that cryptographic secrets, temporary passwords, and Multi-Factor Authentication (MFA) tokens are distributed securely, handled properly by personnel, and restricted in accordance with the Principle of Least Privilege and Role-Based Access Control (RBAC).
System administrators holding account-creation privileges are formally indexed within anDREa People HR. These administrators are responsible for executing secure credential distribution, handling reset workflows, and monitoring authentication compliance within their respective technical domains.
2. Core Systems Authentication Architecture
Authentication profiles and enrollment rules are tailored per platform to maintain a secure cloud infrastructure:
┌───────────────────────────────────────────────────────────────────────────┐ │ MFA Enforcement & Assurance Levels │ ├──────────────────┬────────────────────────────────────────────────────────┤ │ myDRE Platform │ Username + Password -> Automatd Temp Pass -> Mandatory │ │ │ First-Login Reset -> Enforced MFA (Number Matching & │ │ │ Geolocation). No self-service resets. │ ├──────────────────┼────────────────────────────────────────────────────────┤ │ Microsoft Azure │ Global Password Policy (Complexity/Age) + Just-In-Time │ │ │ Elevation via Privileged Identity Management (PIM). │ ├──────────────────┼────────────────────────────────────────────────────────┤ │ Google Workspace │ Dedicated anDREa Personnel Only. Enforced MFA with a │ │ │ structural migration path toward Passwordless keys. │ ├──────────────────┼────────────────────────────────────────────────────────┤ │ GitHub & │ Access gated by Microsoft Entra ID Security Group │ │ SonarCloud │ synchronization. Enforced MFA via federated identity. │ ├──────────────────┼────────────────────────────────────────────────────────┤ │ Zoho Desk │ Invited by anDREa Admin -> Self-Enroll Password + MFA. │ │ │ Administrative privileges restricted to trained staff. │ └──────────────────┴────────────────────────────────────────────────────────┘
2.1 myDRE Platform & Microsoft Azure Infrastructure
- Provisioning Pathway: Identity instantiation within the myDRE ecosystem is initiated by a customer's authorized Research Support Team (RST) member using the myDRE Admin Portal. The platform generates and routes an automated temporary credential to the user.
- First-Authentication Requirements: Upon initial login, the user must change the temporary password and complete mandatory enrollment in Multi-Factor Authentication (MFA).
- MFA Context Hardening: Platform MFA challenges enforce rigorous context verification, including number matching and geolocation telemetry, to mitigate push-fatigue or authentication-hijacking exploits. Passkeys and hardware keys are strongly recommended to use as MFA for day-to-day.
- Reset Constraints: End-users and customer administrators are strictly prohibited from performing self-service credential or MFA registration resets. All lifecycle resets are handled by the anDREa Support Team. For customer administrator accounts, resetting an MFA registration requires the support engineer to activate a highly restricted, specialized Azure Privileged Identity Management (PIM) role.
- Global Password Policy: Standard settings across Microsoft Azure enforce strict baseline rules governing password length, algorithmic complexity, expiration intervals, and historical reuse tracking.
2.2 Google Workspace (Corporate Operations)
- Access is strictly restricted to internal anDREa employees. Accounts are provisioned and managed by designated Google Administrators. MFA is mandatory across all accounts, and the Management Team actively drives a migration path to replace traditional passwords with Passwordless (FIDO2/WebAuthn) hardware elements.
2.3 GitHub & SonarCloud (Development Environment)
- Identity Federation: Software engineers are granted access to development environments by being added to a specialized security group within Microsoft Entra ID. Membership in this synchronized identity directory is a mandatory prerequisite to receive a GitHub organizational invitation.
- Code Quality Ecosystem: SonarCloud code-analysis access is federated through the developer's verified GitHub identity. MFA is strictly enforced across all steps of the DevOps pipeline.
2.4 Zoho Desk (Customer Support)
- Customer RST members are invited to Zoho by an anDREa Administrator. New operators configure their own credentials and are subject to mandatory MFA enrollment. Administrator roles are restricted and provisioned only after the completion of specialized system training.
3. Personnel Advising and Awareness
To ensure security awareness across all personnel, anDREa mandates that all employees and contractors complete the Information Security and Data Protection Training (responses) upon onboarding and on a yearly recurring cadence. This curriculum includes explicit training regarding the secure handling of authentication information:
- Prohibition of Credential Sharing: A strict corporate ban on sharing individual user passwords, MFA codes, or identity tokens.
- Credential Management: Guidance encouraging the utilization of enterprise password managers to eliminate weak or reused secrets.
- Social Engineering Defense: Training on identifying and reporting advanced phishing campaigns, reverse-proxy bypasses, and social engineering attacks aimed at stealing credentials.
- Compromise Escalation: Clear instructions on how to immediately report lost hardware tokens, compromised credentials, or anomalous MFA push notifications to the Support Team (A.05.26 - Response to information security incidents).
Authorized Credential Sharing Exceptions
The Support & Assurance team is granted an operational exception to share credentials for platform test user accounts and emergency break-the-glass accounts. These specialized authentication secrets must be stored and accessed exclusively within a secure, encrypted Shared Vault using the 1Password enterprise application.