+IA-02(06) Access to Accounts —separate Device

IA-02(06) Access to Accounts —separate Device

Control

Implement multi-factor authentication for [Selection(one-or-more): local; network; remote] access to [Selection(one-or-more): privileged accounts; non-privileged accounts] such that:
  1. One of the factors is provided by a device separate from the system gaining access; and
  2. The device meets [Assignement: strength of mechanism requirements].

Discussion

The purpose of requiring a device that is separate from the system to which the user is attempting to gain access for one of the factors during multi-factor authentication is to reduce the likelihood of compromising authenticators or credentials stored on the system. Adversaries may be able to compromise such authenticators or credentials and subsequently impersonate authorized users. Implementing one of the factors on a separate device (e.g., a hardware token), provides a greater strength of mechanism and an increased level of assurance in the authentication process.

Assessment Objective

  1. multi-factor authentication is implemented for [Selection(one-or-more): local; network; remote] access to [Selection(one-or-more): privileged accounts; non-privileged accounts] such that one of the factors is provided by a device separate from the system gaining access;
  2. multi-factor authentication is implemented for [Selection(one-or-more): local; network; remote] access to [Selection(one-or-more): privileged accounts; non-privileged accounts] such that the device meets [Assignement: strength of mechanism requirements].

Assessment Method

Examine

Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records

Interview

Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by IA-02(06) Access to Accounts —separate Device – Assessment Procedure
is blocked by Out-of-Band (OOB) Multi-Factor Authentication (MFA)