+IA-04 Identifier Management
---+IA-04(01) Prohibit Account Identifiers as Public Identifiers
---+IA-04(04) Identify User Status
---+IA-04(05) Dynamic Management
---+IA-04(06) Cross-organization Management
---+IA-04(08) Pairwise Pseudonymous Identifiers
---+IA-04(09) Attribute Maintenance and Protection
|
IA-04 Identifier Management
Control
Manage system identifiers by:- Receiving authorization from [Assignement: personnel or roles] to assign an individual, group, role, service, or device identifier;
- Selecting an identifier that identifies an individual, group, role, service, or device;
- Assigning the identifier to the intended individual, group, role, service, or device; and
- Preventing reuse of identifiers for [Assignement: time period].
Discussion
Common device identifiers include Media Access Control (MAC) addresses, Internet Protocol (IP) addresses, or device-unique token identifiers. The management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the usernames of the system accounts assigned to those individuals. In such instances, the account management activities of [AC-2](#ac-2) use account names provided by [IA-4](#ia-4) . Identifier management also addresses individual identifiers not necessarily associated with system accounts. Preventing the reuse of identifiers implies preventing the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices.
Assessment Objective
- system identifiers are managed by receiving authorization from [Assignement: personnel or roles] to assign to an individual, group, role, or device identifier;
- system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device;
- system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device;
- system identifiers are managed by preventing reuse of identifiers for [Assignement: time period].
Assessment Method
Examine
Identification and authentication policy
procedures addressing identifier management
procedures addressing account management
system security plan
system design documentation
system configuration settings and associated documentation
list of system accounts
list of identifiers generated from physical access control devices
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
1. Přehled
| Název |
Standard |
|
IA-04(01) Prohibit Account Identifiers as Public Identifiers
|
Control
Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.
Discussion
Prohibiting account identifiers as public identifiers applies to any publicly disclosed account identifier used for communication such as, electronic mail and instant messaging. Prohibiting the use of systems account identifiers that are the same as some public identifier, such as the individual identifier section of an electronic mail address, makes it more difficult for adversaries to guess user identifiers. Prohibiting account identifiers as public identifiers without the implementation of other supporting controls only complicates guessing of identifiers. Additional protections are required for authenticators and credentials to protect the account.
Assessment Objective
the use of system account identifiers that are the same as public identifiers is prohibited for individual accounts.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing identifier management
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
system/network administrators
|
|
IA-04(04) Identify User Status
|
Control
Manage individual identifiers by uniquely identifying each individual as [Assignement: characteristics].
Discussion
Characteristics that identify the status of individuals include contractors, foreign nationals, and non-organizational users. Identifying the status of individuals by these characteristics provides additional information about the people with whom organizational personnel are communicating. For example, it might be useful for a government employee to know that one of the individuals on an email message is a contractor.
Assessment Objective
individual identifiers are managed by uniquely identifying each individual as [Assignement: characteristics].
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing identifier management
procedures addressing account management
list of characteristics identifying individual status
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
system/network administrators
|
|
IA-04(05) Dynamic Management
|
Control
Manage individual identifiers dynamically in accordance with [Assignement: dynamic identifier policy].
Discussion
In contrast to conventional approaches to identification that presume static accounts for preregistered users, many distributed systems establish identifiers at runtime for entities that were previously unknown. When identifiers are established at runtime for previously unknown entities, organizations can anticipate and provision for the dynamic establishment of identifiers. Pre-established trust relationships and mechanisms with appropriate authorities to validate credentials and related identifiers are essential.
Assessment Objective
individual identifiers are dynamically managed in accordance with [Assignement: dynamic identifier policy].
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing identifier management
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-04(06) Cross-organization Management
|
Control
Coordinate with the following external organizations for cross-organization management of identifiers: [Assignement: external organizations].
Discussion
Cross-organization identifier management provides the capability to identify individuals, groups, roles, or devices when conducting cross-organization activities involving the processing, storage, or transmission of information.
Assessment Objective
cross-organization management of identifiers is coordinated with [Assignement: external organizations].
Assessment Method
Examine
Identification and authentication policy
procedures addressing identifier management
procedures addressing account management
system security plan
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
|
|
IA-04(08) Pairwise Pseudonymous Identifiers
|
Control
Generate pairwise pseudonymous identifiers.
Discussion
A pairwise pseudonymous identifier is an opaque unguessable subscriber identifier generated by an identity provider for use at a specific individual relying party. Generating distinct pairwise pseudonymous identifiers with no identifying information about a subscriber discourages subscriber activity tracking and profiling beyond the operational requirements established by an organization. The pairwise pseudonymous identifiers are unique to each relying party except in situations where relying parties can show a demonstrable relationship justifying an operational need for correlation, or all parties consent to being correlated in such a manner.
Assessment Objective
pairwise pseudonymous identifiers are generated.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing identifier management
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
|
|
IA-04(09) Attribute Maintenance and Protection
|
Control
Maintain the attributes for each uniquely identified individual, device, or service in [Assignement: protected central storage].
Discussion
For each of the entities covered in [IA-2](#ia-2), [IA-3](#ia-3), [IA-8](#ia-8) , and [IA-9](#ia-9) , it is important to maintain the attributes for each authenticated entity on an ongoing basis in a central (protected) store.
Assessment Objective
the attributes for each uniquely identified individual, device, or service are maintained in [Assignement: protected central storage].
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing identifier management
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
|
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|