2 cissp ® Official Study Guide Eighth Edition

 Account Management 
Account management reviews ensure that users only retain authorized permissions and that 
unauthorized modifi cations do not occur. Account management reviews may be a function 
of information security management personnel or internal auditors. 
One way to perform account management is to conduct a full review of all accounts. 
This is typically done only for highly privileged accounts because of the amount of time 
consumed. The exact process may vary from organization to organization, but here’s one 
example: 
1.
Managers ask system administrators to provide a list of users with privileged access 
and the privileged access rights. They may monitor the administrator as they retrieve 
this list to avoid tampering. 
2.
Managers ask the privilege approval authority to provide a list of authorized users and 
the privileges they should be assigned. 
3.
The managers then compare the two lists to ensure that only authorized users 
retain access to the system and that the access of each user does not exceed their 
authorization.
This process may include many other checks, such as verifying that terminated users do 
not retain access to the system, checking the paper trail for specifi c accounts, or other tasks. 
Organizations that do not have time to conduct this thorough process may use sampling 
instead. In this approach, managers pull a random sample of accounts and perform a full 
verifi cation of the process used to grant permissions for those accounts. If no signifi cant 
fl aws are found in the sample, they make the assumption that this is representative of the 
entire population. 
Sampling only works if it is random! Don’t allow system administrators 
to generate the sample or use nonrandom criteria to select accounts for 
review, or you may miss entire categories of users where errors may exist.
Organizations may also automate portions of their account review process. Many iden-
tity and access management (IAM) vendors provide account review workfl ows that prompt 
administrators to conduct reviews, maintain documentation for user accounts, and provide 
an audit trail demonstrating the completion of reviews.