Required New function for SECURITY RISK .

Need New functionality to overcome the below Risk.

EPF Policy Reference

POL-080304 Concurrent session

POL-080507 Periodic force password change

POL-080508 Dormant user ID

3 security checklist control:

1. The Administrator should have the capability to change the password of any User Id anytime; based on their Administrator/Security Group level authorities (must adhere to segregation of duties).

2. Administrator can force log-off User Ids which cannot be used by the users since the system considers these User Ids to be still logged in the system.

3. If application user ID is synchronized with AD (Active Directory), user ID can be managed within the application/system itself instead of using AD.

Risk Description/Background

API Project has 4 components. During project implementation phase discovered there are several security policies and controls

unable to fulfil/comply by (some of) 4 components.

Developer Portal

 Accessible by Public, API technical & DTD operation team.

 Local user registry authentication

API Manager

 Accessible by internal users (business i.e. API Governance Team), API technical & DTD operation team

 LDAP authentication

API Gateway

 Accessible by API technical & DTD operation team

 Local user registry authentication Cloud Manager

 Accessible by API technical & DTD operation team

 LDAP authentication

Risk and Implication

Details of non-compliant table refer below.

- Unauthorized access might not be able to force logout by security admin

- Dormant ID remain in the system

- Security admin unable to manage the user management locally at each components