+IA-05 [M] Authenticator Management
---+IA-05(01) [M] Password-based Authentication
---+IA-05(02) [M] Public Key-based Authentication
---+IA-05(06) [M] Protection of Authenticators

IA-05 [M] Authenticator Management

Control

Manage system authenticators by:
  1. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;
  2. Establishing initial authenticator content for any authenticators issued by the organization;
  3. Ensuring that authenticators have sufficient strength of mechanism for their intended use;
  4. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;
  5. Changing default authenticators prior to first use;
  6. Changing or refreshing authenticators [Assignement: time period by authenticator type] or when [Assignement: events] occur;
  7. Protecting authenticator content from unauthorized disclosure and modification;
  8. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and
  9. Changing authenticators for group or role accounts when membership to those accounts changes.

Discussion

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control [PL-4](#pl-4) or [PS-6](#ps-6) for authenticators in the possession of individuals and by controls [AC-3](#ac-3), [AC-6](#ac-6) , and [SC-28](#sc-28) for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges. Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.

Assessment Objective

  1. system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution;
  2. system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization;
  3. system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use;
  4. system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators;
  5. system authenticators are managed through the change of default authenticators prior to first use;
  6. system authenticators are managed through the change or refreshment of authenticators [Assignement: time period by authenticator type] or when [Assignement: events] occur;
  7. system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification;
    1. system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators;
    2. system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators;
  9. system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes.

Assessment Method

Examine

Identification and authentication policy system security plan addressing authenticator management system design documentation system configuration settings and associated documentation list of system authenticator types change control records associated with managing system authenticators system audit records other relevant documents or records

Interview

Organizational personnel with authenticator management responsibilities organizational personnel with information security responsibilities system/network administrators

1. Přehled

IA-05(01) [M] Password-based Authentication

Control

For password-based authentication:
  1. Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignement: frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
  2. Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);
  3. Transmit passwords only over cryptographically-protected channels;
  4. Store passwords using an approved salted key derivation function, preferably using a keyed hash;
  5. Require immediate selection of a new password upon account recovery;
  6. Allow user selection of long passwords and passphrases, including spaces and all printable characters;
  7. Employ automated tools to assist the user in selecting strong password authenticators; and
  8. Enforce the following composition and complexity rules: [Assignement: composition and complexity rules].

Discussion

Password-based authentication applies to passwords regardless of whether they are used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.

Assessment Objective

  1. for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [Assignement: frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
  2. for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a);
  3. for password-based authentication, passwords are only transmitted over cryptographically protected channels;
  4. for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash;
  5. for password-based authentication, immediate selection of a new password is required upon account recovery;
  6. for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters;
  7. for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators;
  8. for password-based authentication, [Assignement: composition and complexity rules] are enforced.

Assessment Method

Examine

Identification and authentication policy password policy procedures addressing authenticator management system security plan system design documentation system configuration settings and associated documentation password configurations and associated documentation other relevant documents or records

Interview

Organizational personnel with authenticator management responsibilities organizational personnel with information security responsibilities system/network administrators system developers
IA-05(02) [M] Public Key-based Authentication

Control

  1. For public key-based authentication:
    1. Enforce authorized access to the corresponding private key; and
    2. Map the authenticated identity to the account of the individual or group; and
  2. When public key infrastructure (PKI) is used:
    1. Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and
    2. Implement a local cache of revocation data to support path discovery and validation.

Discussion

Public key cryptography is a valid authentication mechanism for individuals, machines, and devices. For PKI solutions, status information for certification paths includes certificate revocation lists or certificate status protocol responses. For PIV cards, certificate validation involves the construction and verification of a certification path to the Common Policy Root trust anchor, which includes certificate policy processing. Implementing a local cache of revocation data to support path discovery and validation also supports system availability in situations where organizations are unable to access revocation information via the network.

Assessment Objective

    1. authorized access to the corresponding private key is enforced for public key-based authentication;
    2. the authenticated identity is mapped to the account of the individual or group for public key-based authentication;
    1. when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information;
    2. when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation.

Assessment Method

Examine

Identification and authentication policy procedures addressing authenticator management system security plan system design documentation system configuration settings and associated documentation PKI certification validation records PKI certification revocation lists other relevant documents or records

Interview

Organizational personnel with PKI-based, authenticator management responsibilities organizational personnel with information security responsibilities system/network administrators system developers
IA-05(06) [M] Protection of Authenticators

Control

Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.

Discussion

For systems that contain multiple security categories of information without reliable physical or logical separation between categories, authenticators used to grant access to the systems are protected commensurate with the highest security category of information on the systems. Security categories of information are determined as part of the security categorization process.

Assessment Objective

authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.

Assessment Method

Examine

Identification and authentication policy procedures addressing authenticator management security categorization documentation for the system security assessments of authenticator protections risk assessment results system security plan other relevant documents or records

Interview

Organizational personnel with authenticator management responsibilities organizational personnel implementing and/or maintaining authenticator protections organizational personnel with information security responsibilities system/network administrators

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by IA-05 [M] Authenticator Management – Assessment Procedure
is blocked by Authenticator Management
is blocked by Default Authenticators