6.2 Threat Mitigation Strategies

Table 4 summarizes related mechanisms that assist in mitigating the threats described in Table 3.

Table 4. Mitigating authenticator threats

Authenticator Threat/Attack	Threat Mitigation Mechanisms	Normative Reference Sections
Theft	Use multi-factor authenticators that must be activated through a password or biometric.	2.2.1, 2.3.1
	Use a combination of authenticators that includes a password or biometric.	2.2.1, 2.3.1
Duplication	Use authenticators from which it is difficult to extract and duplicate long-term authentication secrets.	2.2.2, 2.3.2, 3.1.6.1
	Enforce AAL2 requirements for access to sync fabrics that contain exported authentication keys, and only allow them to be imported into trusted devices.	3.1.7.1
Eavesdropping	Ensure the endpoint’s security before use, especially with respect to freedom from malware (e.g., key loggers).	2.2.2
	Avoid using unauthenticated and unencrypted communication channels to send out-of-band authenticator secrets.	3.1.3.1
	Authenticate over authenticated protected channels (e.g., observe the lock icon in the browser window).	2.1.2, 2.2.2, 2.3.2
	Use authentication protocols that are resistant to replay attacks (e.g., pass-the-hash).	3.2.7
	Use authentication endpoints that employ trusted input and display capabilities.	3.1.6.1, 3.1.7.1
Offline Cracking	Use an authenticator with a high entropy authenticator secret.	3.1.2.1, 3.1.4.1, 3.1.5.1, 3.1.6.1, 3.1.7.1
	Store centrally verified passwords in a salted, hashed form, including a keyed hash.	3.1.1.1.2
Side-Channel Attack	Use authenticator algorithms that maintain constant power consumption and timing, regardless of secret values.	2.3.2
Phishing or Pharming	Use authenticators that provide phishing resistance.	3.2.5
Social Engineering	Avoid using authenticators that present a social engineering risk to third parties (e.g., customer service agents).	4.1.2.1, 4.2
Authentication Fatigue	Require the transfer of an authentication secret for OOB authentication rather than approval.	3.1.3
Online Guessing	Use authenticators that generate high-entropy output.	3.1.2.1, 3.1.6.1, 3.1.7.1
	Use an authenticator that locks after repeated failed activation attempts.	3.2.2
Endpoint Compromise	Use hardware authenticators that require physical action by the claimant.	3.2.8
	Maintain software-based keys in storage with restricted access.	3.1.3.1, 3.1.6.1, 3.1.7.1, 3.2.13
Unauthorized Binding	Provision authenticators and associated keys using authenticated protected channels or in person.	4.1
Latent Keys	Ensure the secure disposal of equipment that contains device-based authentication keys.	4.4, 4.5
	In federal enterprise applications, limit the transfer of keys to organizationally managed or trusted devices.	B.2
Key Transfer Security	Encourage or require subscribers to use cloud services that have been approved for key storage and transfer.	B.2

Several other strategies may be applied to mitigate the threats described in Table 4:

Multiple factors make successful attacks more difficult to accomplish. If an attacker must steal a cryptographic authenticator and guess a password, then the work to discover both factors may be too high.

Physical security mechanisms may be employed to protect a stolen authenticator from duplication. Physical security mechanisms can provide tamper evidence, detection, and response.

Requiring long passwords that do not appear in common dictionaries may force attackers to try every possible value.

System and network security controls may be employed to prevent an attacker from gaining access to a system or installing malicious software.

Periodic training may be performed to ensure that subscribers understand when and how to report a compromise or a suspicion of compromise and to recognize patterns of behavior that may signify that an attacker is attempting to compromise the authentication process.

Out-of-band techniques may be employed to verify the proof of possession of registered devices (e.g., cell phones).

1. Přehled

Název	Standard

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky
Zdroj	Požadavek

3. Související regulace

Regulace
Zdroj	Regulace

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.