+03.05.02 Device Identification and Authentication

03.05.02 Device Identification and Authentication

Statement

Uniquely identify and authenticate {{ insert: param, A.03.05.02.ODP.01 }} before establishing a system connection.

Guidance

Devices that require unique device-to-device identification and authentication are defined by type, device, or a combination of type and device. Organization-defined device types include devices that are not owned by the organization. Systems use shared known information (e.g., Media Access Control .MAC, Transmission Control Protocol/Internet Protocol .TCP/IP addresses) for device identification or organizational authentication solutions (e.g., Institute of Electrical and Electronics Engineers .IEEE 802.1x and Extensible Authentication Protocol .EAP, RADIUS server with EAP-Transport Layer Security .TLS authentication, Kerberos) to identify and authenticate devices on local and wide area networks. Public Key Infrastructure (PKI) and certificate revocation checking for the certificates exchanged can be included as part of device authentication.

Assessment objective

{{ insert: param, A.03.05.02.ODP.01 }} are authenticated before establishing a system connection.

Assessment objective

{{ insert: param, A.03.05.02.ODP.01 }} are uniquely identified before establishing a system connection.

Assessment method

  • identification and authentication policy and procedures procedures for device identification and authentication system design documentation list of devices requiring unique identification and authentication device connection reports system configuration settings system security plan other relevant documents or records

Assessment method

  • personnel with responsibilities for device identification and authentication personnel with information security responsibilities system developers system administrators

Assessment method

  • mechanisms for supporting or implementing device identification and authentication capabilities

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by 03.05.02 Device Identification and Authentication – Assessment Procedure
is blocked by Authenticate, Authorize and Audit (AAA)
is blocked by Identification & Authentication for Devices
is blocked by Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)