+IA-02(08) [L] Access to Accounts — Replay Resistant

IA-02(08) [L] Access to Accounts — Replay Resistant

Control

Implement replay-resistant authentication mechanisms for access to [Selection(one-or-more): privileged accounts; non-privileged accounts].

Discussion

Authentication processes resist replay attacks if it is impractical to achieve successful authentications by replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or cryptographic authenticators.

Assessment Objective

replay-resistant authentication mechanisms for access to [Selection(one-or-more): privileged accounts; non-privileged accounts] are implemented.

Assessment Method

Examine

Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of privileged system accounts other relevant documents or records

Interview

Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by IA-02(08) [L] Access to Accounts — Replay Resistant – Assessment Procedure
is blocked by Replay-Resistant Authentication