3.5 Identification and Authentication

Statement

Authenticate {{ insert: param, A.03.05.01E.ODP.01 }} before establishing a system connection using bidirectional authentication that is cryptographically based.

Guidance

Bidirectional authentication provides stronger protection to validate the identity of other devices for connections that are of greater risk. This requirement enhances SP 800-171 requirement 03.05.02.

Statement

• (includes preempt and negate) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

{{ insert: param, A.03.05.01E.ODP.01 }} are authenticated before establishing a system connection using bidirectional authentication that is cryptographically based.

Assessment method

• Identification and authentication policy system security plan procedures addressing device identification and authentication system design documentation configuration settings and associated documentation list of devices requiring unique identification and authentication device connection reports other relevant documents or records

Assessment method

• Personnel with operational responsibilities for device identification and authentication personnel with information security responsibilities system/network administrators system developers

Assessment method

• Mechanisms supporting and/or implementing device authentication capabilities cryptographically based bidirectional authentication mechanisms

Statement

• Employ {{ insert: param, A.03.05.02E.ODP.01 }} to generate and manage passwords.

• Protect the passwords using {{ insert: param, A.03.05.02E.ODP.02 }} .

Guidance

A potential risk of using password managers is that adversaries can target the collection of passwords generated by the password manager. Therefore, the passwords require strong protection, including encrypting the passwords. This requirement enhances SP 800-171 requirement 03.05.07.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes delay and exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

{{ insert: param, A.03.05.02E.ODP.01 }} are employed to generate and manage passwords.

Assessment objective

passwords are protected using {{ insert: param, A.03.05.02E.ODP.02 }} .

Assessment method

• Identification and authentication policy procedures addressing identifier management system security plan system design documentation mechanisms providing dynamic binding of identifiers and authenticators system configuration settings and associated documentation system audit records other relevant documents or records

Assessment method

• Personnel with identification and authentication management responsibilities personnel with information security responsibilities system/network administrators

Assessment method

• Mechanisms supporting and/or implementing account management capabilities mechanisms supporting and/or implementing identification and authentication management capabilities for the system

Statement

Handle device identification and authentication based on attestation by {{ insert: param, A.03.05.03E.ODP.01 }}.

Guidance

Device attestation refers to the identification and authentication of a device based on its configuration and known operating state. Device attestation can be determined via a cryptographic hash of the device. If device attestation is the means of identification and authentication, then it is important that patches and updates to the device are handled via a configuration management process such that the patches and updates are done securely and do not disrupt identification and authentication to other devices. This requirement enhances SP 800-171 requirement 03.05.02.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

device identification and authentication are handled based on attestation by {{ insert: param, A.03.05.03E.ODP.01 }}.

Assessment method

• Identification and authentication policy system security plan procedures addressing device identification and authentication procedures addressing device configuration management system design documentation system configuration settings and associated documentation configuration management records change control records system audit records other relevant documents or records

Assessment method

• Personnel with operational responsibilities for device identification and authentication personnel with information security responsibilities system/network administrators

Assessment method

• Mechanisms supporting and/or implementing device identification and authentication capabilities mechanisms supporting and/or implementing configuration management cryptographic mechanisms supporting device attestation

Statement

Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.

Guidance

In addition to applications, other forms of static storage include access scripts and function keys. Organizations exercise caution when determining whether embedded or stored authenticators are encrypted or unencrypted. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators. This requirement enhances SP 800-171 requirement 03.05.07.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

unencrypted static authenticators are not embedded in applications or other forms of static storage.

Assessment method

• Identification and authentication policy system security plan procedures addressing authenticator management system design documentation system configuration settings and associated documentation logical access scripts application code reviews for detecting unencrypted static authenticators other relevant documents or records

Assessment method

• Personnel with authenticator management responsibilities personnel with information security responsibilities system/network administrators system developers

Assessment method

• Mechanisms supporting and/or implementing authenticator management capabilities mechanisms implementing authentication in applications

Statement

Prohibit the use of cached authenticators after {{ insert: param, A.03.05.05E.ODP.01 }}.

Guidance

Cached authenticators are used to authenticate to a local machine when the network is not available. If cached authentication information is out of date, the validity of the authentication information may be questionable. This requirement enhances SP 800-171 requirement 03.05.07.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

the use of cached authenticators is prohibited after {{ insert: param, A.03.05.05E.ODP.01 }}.

Assessment method

• Identification and authentication policy procedures addressing authenticator management system security plan system design documentation system configuration settings and associated documentation system audit records other relevant documents or records

Assessment method

• Personnel with authenticator management responsibilities personnel with information security responsibilities system/network administrators system developers

Assessment method

• Mechanisms supporting and/or implementing authenticator management capabilities

Statement

• Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines.

• Resolve user identities to a unique individual.

• Collect, validate, and verify identity evidence.

Guidance

Identity proofing is the process of collecting, validating, and verifying user identity information to establish credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Resolving user identities ensure each user identity belongs to a unique individual. Organizations may be subject to laws, Executive Orders, directives, regulations, or policies that address the collection of identity evidence. An example of an applicable guideline that covers identity proofing is SP 800-63 .ADD REFERENCE. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity-proofed.

Assessment objective

user identities are resolved to a unique individual.

Assessment objective

identity evidence is collected.

Assessment objective

identity evidence is validated.

Assessment objective

identity evidence is verified.

Assessment method

• Identification and authentication policy procedures addressing identity proofing system security plan other relevant documents or records

Assessment method

• Personnel with system operations responsibilities personnel with information security responsibilities system/network administrators system developers personnel with identification and authentication responsibilities

Assessment method

• Mechanisms supporting and/or implementing identification and authentication capabilities

Statement

Employ identity providers and authorization servers to manage user, device, and non-person entity identities, attributes, and access rights that support authentication and authorization decisions in accordance with {{ insert: param, A.03.05.07E.ODP.01 }} using {{ insert: param, A.03.05.07E.ODP.02 }}.

Guidance

Identity providers (both internal and external to the organization) manage user, device, and non-person entity authenticators and issue statements (often called identity assertions) that attest to the identities of other systems or system components. Authorization servers create and issue access tokens to identified and authenticated users and devices that can be used to gain access to organizational systems or information resources. For example, single sign-on (SSO) provides identity provider and authorization server functions. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

identity providers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with {{ insert: param, A.03.05.07E.ODP.01 }} using {{ insert: param, A.03.05.07E.ODP.02 }}.

Assessment objective

identity providers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authorization decisions in accordance with {{ insert: param, A.03.05.07E.ODP.01 }} using {{ insert: param, A.03.05.07E.ODP.02 }}.

Assessment objective

authorization servers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with {{ insert: param, A.03.05.07E.ODP.01 }} using {{ insert: param, A.03.05.07E.ODP.02 }}.

Assessment method

• Identification and authentication policy procedures addressing user and device identification and authentication system security plan system design documentation system configuration settings and associated documentation other relevant documents or records

Assessment method

• Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators organizational personnel with account management responsibilities system developers

Assessment method

• Mechanisms supporting and/or implementing identification and authentication capabilities and access rights