+6.1 Federation Threats

6.1 Federation Threats

As in non-federated authentication, attackers’ motivations are typically to gain access (or a greater level of access) to a resource or service provided by an RP. Attackers may also attempt to impersonate a subscriber. Rogue or compromised IdPs, RPs, user agents (e.g., browsers), and parties outside of a typical federation transaction are potential attackers. To accomplish their attack, they might intercept or modify assertions and assertion references. Furthermore, two or more entities may attempt to subvert federation protocols by directly compromising the integrity or confidentiality of the assertion data. For these types of threats, any authorized parties who attempt to exceed their privileges are considered attackers.

In federated systems, successful attacks on the IdP can propagate through to the RPs that rely on that IdP for identity and security information. Consequently, an attack against the IdP that targets one agency’s RP could potentially move laterally to another agency’s RP. To mitigate these attacks, RPs need to maintain independent monitoring and threat evaluation capabilities to identify malicious or compromised accounts. Additionally, maintaining information or shared signaling capabilities with appropriate privacy controls can facilitate investigation and remediation at the IdP or CSP and other potentially impacted RPs.

Deviations in identity proofing practices between CSPs and between subscriber accounts within a single CSP are inevitable. CSPs and IdPs need to maintain capabilities to convey information regarding the controls applied to each account to support RP decision-making and investigation when appropriate.

Table 3. Federation threats

Federation Threats/Attacks	Description	Examples
Assertion Manufacture or Modification	The attacker generates a false assertion	Compromised IdP asserts the identity of a claimant who has not properly authenticated
	The attacker modifies an existing assertion	Compromised proxy that changes the AAL of an authentication assertion
Assertion Disclosure	The assertion is visible to a third party	Network monitoring reveals a subscriber address of record to an outside party
Assertion Repudiation by the IdP	The IdP later claims not to have signed the transaction	User engages in a fraudulent credit card transaction at the RP, and the IdP claims not to have logged them in
Assertion Repudiation by the Subscriber	The subscriber claims not to have performed the transaction	The user agreement (e.g., contract) cannot be enforced
Assertion Redirect	The assertion can be used in unintended context	A compromised user agent passes the assertion to an attacker who uses it elsewhere
Assertion Reuse	The assertion can be used more than once with same RP	An intercepted assertion is used by an attacker to authenticate their own session
Assertion Substitution	The attacker uses an assertion that is intended for a different subscriber	There is a session hijack attack between the IdP and RP
Revoked or Stale Attributes	The attacker exploits an RP’s usage of attributes	An attribute bundle with a revoked email address is presented to an RP to allow an attacker to use that email address with the RP

\clearpage

1. Übersicht

Bezeichnung	Standard

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen
Quelle	Anforderung

3. Zugehörige Regulierungen

Regulierungen
Quelle	Regulierung

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.