+IA-02 Identification and Authentication (Organizational Users)
---+IA-02(01) Multi-factor Authentication to Privileged Accounts
---+IA-02(02) Multi-factor Authentication to Non-privileged Accounts
---+IA-02(05) Individual Authentication with Group Authentication
---+IA-02(06) Access to Accounts —separate Device
---+IA-02(08) Access to Accounts — Replay Resistant
---+IA-02(10) Single Sign-on
---+IA-02(12) Acceptance of PIV Credentials
---+IA-02(13) Out-of-band Authentication
|
IA-02 Identification and Authentication (Organizational Users)
Control
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Discussion
Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity.
Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks.
The use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in [IA-8](#ia-8).
Assessment Objective
- organizational users are uniquely identified and authenticated;
- the unique identification of authenticated organizational users is associated with processes acting on behalf of those users.
Assessment Method
Examine
Identification and authentication policy
procedures addressing user identification and authentication
system security plan, system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
organizational personnel with account management responsibilities
system developers
1. Übersicht
| Bezeichnung |
Standard |
|
IA-02(01) Multi-factor Authentication to Privileged Accounts
|
Control
Implement multi-factor authentication for access to privileged accounts.
Discussion
Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification (PIV) card or the Department of Defense (DoD) Common Access Card (CAC). In addition to authenticating users at the system level (i.e., at logon), organizations may employ authentication mechanisms at the application level, at their discretion, to provide increased security. Regardless of the type of access (i.e., local, network, remote), privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can add additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Assessment Objective
multi-factor authentication is implemented for access to privileged accounts.
Assessment Method
Examine
Identification and authentication policy
procedures addressing user identification and authentication
system security plan
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(02) Multi-factor Authentication to Non-privileged Accounts
|
Control
Implement multi-factor authentication for access to non-privileged accounts.
Discussion
Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification card or the DoD Common Access Card. In addition to authenticating users at the system level, organizations may also employ authentication mechanisms at the application level, at their discretion, to provide increased information security. Regardless of the type of access (i.e., local, network, remote), non-privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can provide additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Assessment Objective
multi-factor authentication for access to non-privileged accounts is implemented.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(05) Individual Authentication with Group Authentication
|
Control
When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.
Discussion
Individual authentication prior to shared group authentication mitigates the risk of using group accounts or authenticators.
Assessment Objective
users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(06) Access to Accounts —separate Device
|
Control
Implement multi-factor authentication for [Selection(one-or-more): local; network; remote] access to [Selection(one-or-more): privileged accounts; non-privileged accounts] such that:- One of the factors is provided by a device separate from the system gaining access; and
- The device meets [Assignement: strength of mechanism requirements].
Discussion
The purpose of requiring a device that is separate from the system to which the user is attempting to gain access for one of the factors during multi-factor authentication is to reduce the likelihood of compromising authenticators or credentials stored on the system. Adversaries may be able to compromise such authenticators or credentials and subsequently impersonate authorized users. Implementing one of the factors on a separate device (e.g., a hardware token), provides a greater strength of mechanism and an increased level of assurance in the authentication process.
Assessment Objective
- multi-factor authentication is implemented for [Selection(one-or-more): local; network; remote] access to [Selection(one-or-more): privileged accounts; non-privileged accounts] such that one of the factors is provided by a device separate from the system gaining access;
- multi-factor authentication is implemented for [Selection(one-or-more): local; network; remote] access to [Selection(one-or-more): privileged accounts; non-privileged accounts] such that the device meets [Assignement: strength of mechanism requirements].
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(08) Access to Accounts — Replay Resistant
|
Control
Implement replay-resistant authentication mechanisms for access to [Selection(one-or-more): privileged accounts; non-privileged accounts].
Discussion
Authentication processes resist replay attacks if it is impractical to achieve successful authentications by replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or cryptographic authenticators.
Assessment Objective
replay-resistant authentication mechanisms for access to [Selection(one-or-more): privileged accounts; non-privileged accounts] are implemented.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of privileged system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(10) Single Sign-on
|
Control
Provide a single sign-on capability for [Assignement: system accounts and services].
Discussion
Single sign-on enables users to log in once and gain access to multiple system resources. Organizations consider the operational efficiencies provided by single sign-on capabilities with the risk introduced by allowing access to multiple systems via a single authentication event. Single sign-on can present opportunities to improve system security, for example by providing the ability to add multi-factor authentication for applications and systems (existing and new) that may not be able to natively support multi-factor authentication.
Assessment Objective
a single sign-on capability is provided for [Assignement: system accounts and services].
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing single sign-on capability for system accounts and services
procedures addressing identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts and services requiring single sign-on capability
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(12) Acceptance of PIV Credentials
|
Control
Accept and electronically verify Personal Identity Verification-compliant credentials.
Discussion
Acceptance of Personal Identity Verification (PIV)-compliant credentials applies to organizations implementing logical access control and physical access control systems. PIV-compliant credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. The adequacy and reliability of PIV card issuers are authorized using [SP 800-79-2](#10963761-58fc-4b20-b3d6-b44a54daba03) . Acceptance of PIV-compliant credentials includes derived PIV credentials, the use of which is addressed in [SP 800-166](#e8552d48-cf41-40aa-8b06-f45f7fb4706c) . The DOD Common Access Card (CAC) is an example of a PIV credential.
Assessment Objective
Personal Identity Verification-compliant credentials are accepted and electronically verified.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
PIV verification records
evidence of PIV credentials
PIV credential authorizations
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(13) Out-of-band Authentication
|
Control
Implement the following out-of-band authentication mechanisms under [Assignement: conditions]: [Assignement: out-of-band authentication].
Discussion
Out-of-band authentication refers to the use of two separate communication paths to identify and authenticate users or devices to an information system. The first path (i.e., the in-band path) is used to identify and authenticate users or devices and is generally the path through which information flows. The second path (i.e., the out-of-band path) is used to independently verify the authentication and/or requested action. For example, a user authenticates via a notebook computer to a remote server to which the user desires access and requests some action of the server via that communication path. Subsequently, the server contacts the user via the user’s cell phone to verify that the requested action originated from the user. The user may confirm the intended action to an individual on the telephone or provide an authentication code via the telephone. Out-of-band authentication can be used to mitigate actual or suspected "man-in the-middle" attacks. The conditions or criteria for activation include suspicious activities, new threat indicators, elevated threat levels, or the impact or classification level of information in requested transactions.
Assessment Objective
[Assignement: out-of-band authentication] mechanisms are implemented under [Assignement: conditions].
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
system-generated list of out-of-band authentication paths
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|