Assessment Objective
Determine if:
- IA-13(02)[01] the source of identity assertions is verified before granting access to system and information resources;
- IA-13(02)[02] the source of access tokens is verified before granting access to system and information resources;
- IA-13(02)[03] the integrity of identity assertions is verified before granting access to system and information resources;
- IA-13(02)[04] the integrity of access tokens is verified before granting access to system and information resources
Assessment Methods
Examine
- Identification and authentication policy;
- system security plan; system design documentation;
- system configuration settings and associated documentation;
- other relevant documents or records
Interview
- Organizational personnel with system operations responsibilities;
- organizational personnel with information security responsibilities;
- system/ network administrators;
- organizational personnel with account management responsibilities;
- system developers
Test
- Identity provider mechanisms supporting and/or implementing identification and authentication capabilities and access rights
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | IA-13(02) Verification of Identity Assertions and Access Tokens |