Access Control Policy/Chính sách Kiểm soát Truy cập
Policy Owner: Jarvis (Hai) Luong
Effective Date 25/01/2025
To limit access to information and information processing systems, networks, and facilities to authorized parties in accordance with business objectives.
Để hạn chế quyền truy cập vào thông tin, hệ thống xử lý thông tin, mạng lưới và cơ sở vật chất chỉ dành cho các bên được ủy quyền phù hợp với mục tiêu kinh doanh
All Tekai information systems that process, store, or transmit confidential data as defined in the Tekai Data Management Policy. This policy applies to all employees of Tekai and to all external parties with access to Tekai networks and system resources.
Tất cả các hệ thống thông tin của Tekai xử lý, lưu trữ hoặc truyền tải dữ liệu được định nghĩa bảo mật theo quy định trong Chính sách Quản lý Dữ liệu của Tekai. Chính sách này áp dụng cho tất cả nhân viên của Tekai và tất cả các đối tác bên ngoài có quyền truy cập vào mạng và tài nguyên hệ thống của Tekai.
Access to information computing resources is limited to personnel with a business requirement for such access. Access rights shall be granted or revoked in accordance with this Access Control Policy.
Quyền truy cập vào các hệ thống thông tin được giới hạn cho những nhân sự có nhu cầu nghiệp vụ cần thiết. Quyền truy cập sẽ được cấp hoặc thu hồi theo Chính sách Kiểm soát Truy cập.
Tekai shall determine the type and level of access granted to individual users based on the "principle of least privilege." This principle states that users are only granted the level of access absolutely required to perform their job functions, and is dictated by Tekai's business and security requirements. Permissions and access rights not expressly granted shall be, by default, prohibited.
Tekai's primary method of assigning and maintaining consistent access controls and access rights shall be through the implementation of Role-Based Access Control (RBAC). Wherever feasible, rights and restrictions shall be allocated to groups. Individual user accounts may be granted additional permissions as needed with approval from the system owner or authorized party.
All privileged access to production infrastructure shall use Multi-Factor Authentication (MFA).
The following security standards shall govern access to Tekai networks and network services:
When configuring cross-account access using AWS IAM roles, you must use a value you generate for the external ID, instead of one provided by the customer, to ensure the integrity of the cross account role configuration. A partner-generated external ID ensures that malicious parties cannot impersonate a customer's configuration and enforces uniqueness and format consistency across all customers.
The external IDs used must be unique across all customers. Re-using external IDs for different customers does not solve the confused deputy problem and runs the risk of customer A being able to view data of customer B by using the role ARN of customer B along with the external ID of customer B.
Customers must not be able to set or influence external IDs. When the external ID is editable, it is possible for one customer to impersonate the configuration of another.
Tekai requires that all personnel have a unique user identifier for system access, and that user credentials and passwords are not shared between multiple personnel. Users with multiple levels of access (e.g. administrators) should be given separate accounts for normal system use and for administrative functions wherever feasible. Root, service, and administrator accounts may use a password management system to share passwords for business continuity purposes only.
Administrators shall only use shared administrative accounts as needed. If a password is compromised or suspected of compromise the incident should be escalated to IR Team immediately and the password must be changed.
Only authorized administrators shall be permitted to create new user IDs, and may only do so upon receipt of a documented request from authorized parties. User provisioning requests must include approval from data owners or Tekai management authorized to grant system access. Prior to account creation, administrators should verify that the account does not violate any Tekai security or system access control policies such as segregation of duties, fraud prevention measures, or access rights restrictions.
User IDs shall be promptly disabled or removed when users leave the organization or contract work ends in accordance with SLAs. User IDs shall not be re-used.
Granting of administrative rights shall be strictly controlled, and requires approval from the asset owner.
Administrators shall perform access rights reviews of user, administrator, and service accounts on a quarterly basis to verify that user access is limited to systems that are required for their job function. Access reviews shall be documented.
Access reviews may include group membership as well as evaluations of any specific or exception- based permission. Access rights shall also be reviewed as part of any job role change, including promotion, demotion, or transfer within the company.
The access rights of all users shall be promptly removed upon termination of their employment or contract, or when rights are no longer needed due to a change in job function or role. The maximum allowable time period for access termination is 24 business hours.
The Access Management Procedure for Tekai systems can be found in Appendix A to this policy.
Conflicting duties and areas of responsibility shall be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of Tekai assets. When provisioning access, care should be taken that no single person can access, modify or use assets without authorization or detection. The initiation of an event should be separated from its authorization. The possibility of collusion should be considered when determining access levels for individuals and groups.
Control and management of individual user passwords is the responsibility of all Tekai personnel and third-party users. Users shall protect secret authentication information in accordance with the Information Security Policy.
Where feasible, passwords for confidential systems shall be configured for at least the following requirements:
Applications must restrict access to program functions and information to authorized users and support personnel in accordance with the defined access control policy. The level and type of restrictions applied by each application should be based on the individual application requirements, as identified by the data owner. The application-specific access control policy must also conform to Tekai policies regarding access controls and data management.
Prior to implementation, evaluation criteria are to be applied to application software to determine the necessary access controls and data policies. Assessment criteria include, but are not limited to:
All unnecessary default accounts must be removed or disabled before making a system available on the network. Specifically, vendor default passwords and credentials must be changed on all Tekai systems, devices, and infrastructure prior to deployment. This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, and Simple Network Management Protocol (SNMP) community strings where feasible.
Secure log-on controls shall be designed and selected in accordance with the sensitivity of data and the risk of unauthorized access based on the totality of the security and access control architecture.
Systems for managing passwords should be interactive and assist Tekai personnel in maintaining password standards by enforcing password strength criteria including minimum length, and password complexity where feasible.
All storage and transmission of passwords is to be protected using appropriate cryptographic protections, either through hashing or encryption.
Use of utility programs, system files, or other software that might be capable of overriding system and application controls or altering system configurations must be restricted to the minimum personnel required. Systems are to maintain logs of all use of system utilities or alteration of system configurations. Extraneous system utilities or other privileged programs are to be removed or disabled as part of the system build and configuration process.
Management approval is required prior to the installation or use of any ad hoc or third-party system utilities.
Access to program source code and associated items, including designs, specifications, verification plans, and validation plans shall be strictly controlled in order to prevent the introduction of unauthorized functionality into software, avoid unintentional changes, and protect Tekai intellectual property.
All access to source code shall be based on business need and must be logged for review and audit.
Requests for an exception to this Policy must be submitted to the CIO for approval.
Any known violations of this policy should be reported to the CIO. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.
Version | Date | Description | Author | Approved by |
1.0 | 01-03-2025 | First version | Lucas | |
At the completion of the onboarding process, The employee will send an email to the CIO/CTO that will generate a series of service tickets for access.
CIO/CTO will provision access for all company-wide systems as well as engineering systems for the Members of Technical Staff (MTS) group.
Additional access, beyond standard pre-approved access, must be requested and approved by a manager or system owner.