4.4 Considering the users of the system
To consider a secure system, define the system users first. Clarify which users are expected to access the system and clearly define the purpose and scope of work for each user. This will provide a base for verifying whether a given operation is performed by an authorized user who is permitted to carry out that operation -- one of the objectives of system auditing.
The work procedures of each user must be defined by preparing work procedure documents. Such work procedure documents might include System Setup Procedure, System Operating Procedure, End-User Operating Procedure, and Entry and Exit Procedure documents. For a description of considerations for work procedure documentation, see 4.9 Considering work procedures.
For this example system, the following users are defined:
- System administrator
-
The System administrator is responsible for configuring and managing the system according to a System Setup Procedure document. Specifically, the System administrator mainly performs the following types of work:
-
Installing and configuring hardware, software, and networks within the server area
-
Updating software
-
Starting and stopping the system
A user selected from the Information Systems department of the company serves as the System administrator.
-
- System operator
-
System operators are responsible for operational work within the server area, including registration and deletion of end-users, according to a System Operating Procedure document. Users entrusted by the Information Systems department of the company serve as System operators.
- End-user
-
End-users access system-provided services according to an End-User Operating Procedure document. End-users access services via a Web browser on a client terminal connected to an internal LAN.
- Auditor
-
The Auditor is responsible for entering and exiting the server area to collect audit logs according to an Entry and Exit Procedure document. The Auditor examines the collected audit logs and verifies whether the system has been configured in the appropriate manner by a trusted System administrator in accordance with the System Setup Procedure document. The Auditor also verifies whether the system is operated and used in the appropriate manner in accordance with the System Operating Procedure and End-User Operating Procedure documents. A user selected from the Compliance department of the company responsible for internal auditing serves as the Auditor.