...
The VNF MUST, if not integrated with the operator's IAM system, provide a mechanism for assign assigning roles and/or permissions to an identity.
Requirement: NEW
The VNF MUST support at least the following roles: system administrator, application administrator, network function O&M.
Access Control
Requirement: R-42874
CHANGE - The VNF MUST allow the Operator to restrict access to protected resources based on the assigned permissions associated with an ID in order to support Least Privilege (no more privilege than required to perform job functions).
...
Requirement: R-23135
CHANGE - The VNF MUST, if not integrated with the Operator’s identity and access management system, authenticate all access to protected resources GUIs, CLIs, and APIs.
REMOVE - Requirement: R-71787
NEED MORE DISCUSSION - Each architectural layer of the VNF (eg. operating system, network, application) MUST support access restriction independently of all other layers so that Segregation of Duties can be implemented.
NO CHANGE - Requirement: R-59391
The VNF MUST NOT allow the assumption of the permissions of another account to mask individual accountability. For example, use SUDO when a user requires elevated permissions such as root or admin.
CHANGE - Requirement: R-81147
The VNF MUST support strong authentication, also known as multifactor authentication, on all protected interfaces exposed by the VNF for use by human users. Strong authentication uses at least two of the three different types of authentication factors in order to prove the claimed identity of a user.
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support multifactor authentication on all protected interfaces exposed by the VNF for use by human users.
Requirement: R-79107
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support the ability to disable the userID after a configurable number of consecutive unsuccessful authentication attempts using the same userID.
...