Test Permissions of Guest/Training Accounts (OTG-IDENT-006)

Summary
Guest and Training accounts are useful ways to acquaint potential users with system functionality prior to them completing the authorisation process required for access. However, these accounts are often modeled on business roles and may be provisioned with access to more functionality than is required for the user.

Test objectives
Evaluate consistency between access policy and guest/training account access permissions

Example


Remediation
Ensure the application returns consistent generic error messages in response to invalid account name, password or other user credentials entered during the login process.

Ensure default system accounts and test accounts are deleted prior to releasing the system into production (or exposing it to an untrusted network).