Passwords, regulations

The first draft of the new requirement had draconian security requirements, softened (as is common) after a comment period Demands for biometric identifiers were replaced with password control options. But the revised final regulation was still broad in scope and necessitated extensive documentation and testing for all systems used in the industry (with even stronger controls if the user opted for electronic signatures). 

Passwords are one of many methods used to authenticate authorized users. As security of computer systems performing regulated operations is so very critical, expectations for activities (such as assignment, security, and maintenance of passwords) are clearly established by the FDA. Before Part 11, the FDA expected4 that passwords would be ... 

The implementation of an effective security regime is required to comply with the regulators expectations for control of electronic records. The pharmaceutical manufacturer will be responsible for providing maintenance of the security aspects of LIMS. This is normally accomplished through software protection (e.g., passwords and log-on accounts) but may also take the form of protection through physical restrictions (e.g., locked-up or restricted areas). The management of this function should be in accordance with a formal SOP. The use of passwords and high-level accounts must be strictly controlled to prevent security breaches. Typical examples of control should be ... 

Authentication is usually performed by entering a unique user identification (ID) and password. If data are transferred automatically from external software, the source system either must provide a similar mechanism to identify a valid user or the external system has to log on to the record manager with a unique identifier. In any case, data that are entering a compliant-ready record manager require this identification. The authentication needs to be logged with a date and time stamp in an audit trail. The same requirement applies to the modification of data that already exist in the record, if the user is not already in an authenticated session. In fully regulated environments, a reason for the modification has to be supplied before changes can be made. 

PLASCAMS Computer-aided materials selector. Access is regulated by user ID and password). RAPRA Technology Ltd. Shawbury, Shrewsbury, Shropshire SY4 4NR, U.K., tel -t-44-1939-250-383,... 

In addition to the hardware being introduced, there has been a continual improvement in software. Before the interest in pharmaceuticals, a tightly regulated industry, software was considered a research tool. That is, programs seldom had signature slots and passwords they were tools. Now, with an eye to FDA approval, almost every instrument company and third-party software provider has provisions for security and paper trails. A paper trail is simply a continuous documentation of... 

In another study, vulnerability assessment of cyber security in a SC ADA system used to control the operation of the power grid is presented in [14]. Two submodels are used for the system a firewall model that regulates the packets flowing between the networks, and a password model, which is used to monitor penetration attempts. Petri nets are used to model the system, and simulation is used to provide an estimate of the vulnerability of the system to security attacks launched against it. This work is similar to our work, in the sense that it addresses control of the power grid however, their focus is on security aspects of the system, rather than reliability. 

---