+IA-02 [H] Identification and Authentication (Organizational Users)
---+IA-02(01) [H] Multi-factor Authentication to Privileged Accounts
---+IA-02(02) [H] Multi-factor Authentication to Non-privileged Accounts
---+IA-02(05) [H] Individual Authentication with Group Authentication
---+IA-02(08) [H] Access to Accounts — Replay Resistant
---+IA-02(12) [H] Acceptance of PIV Credentials
|
IA-02 [H] Identification and Authentication (Organizational Users)
Control
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Discussion
Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity.
Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks.
The use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in [IA-8](#ia-8).
Assessment Objective
- organizational users are uniquely identified and authenticated;
- the unique identification of authenticated organizational users is associated with processes acting on behalf of those users.
Assessment Method
Examine
Identification and authentication policy
procedures addressing user identification and authentication
system security plan, system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
organizational personnel with account management responsibilities
system developers
1. Übersicht
| Bezeichnung |
Standard |
|
IA-02(01) [H] Multi-factor Authentication to Privileged Accounts
|
Control
Implement multi-factor authentication for access to privileged accounts.
Discussion
Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification (PIV) card or the Department of Defense (DoD) Common Access Card (CAC). In addition to authenticating users at the system level (i.e., at logon), organizations may employ authentication mechanisms at the application level, at their discretion, to provide increased security. Regardless of the type of access (i.e., local, network, remote), privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can add additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Assessment Objective
multi-factor authentication is implemented for access to privileged accounts.
Assessment Method
Examine
Identification and authentication policy
procedures addressing user identification and authentication
system security plan
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(02) [H] Multi-factor Authentication to Non-privileged Accounts
|
Control
Implement multi-factor authentication for access to non-privileged accounts.
Discussion
Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification card or the DoD Common Access Card. In addition to authenticating users at the system level, organizations may also employ authentication mechanisms at the application level, at their discretion, to provide increased information security. Regardless of the type of access (i.e., local, network, remote), non-privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can provide additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Assessment Objective
multi-factor authentication for access to non-privileged accounts is implemented.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(05) [H] Individual Authentication with Group Authentication
|
Control
When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.
Discussion
Individual authentication prior to shared group authentication mitigates the risk of using group accounts or authenticators.
Assessment Objective
users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(08) [H] Access to Accounts — Replay Resistant
|
Control
Implement replay-resistant authentication mechanisms for access to [Selection(one-or-more): privileged accounts; non-privileged accounts].
Discussion
Authentication processes resist replay attacks if it is impractical to achieve successful authentications by replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or cryptographic authenticators.
Assessment Objective
replay-resistant authentication mechanisms for access to [Selection(one-or-more): privileged accounts; non-privileged accounts] are implemented.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
list of privileged system accounts
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
IA-02(12) [H] Acceptance of PIV Credentials
|
Control
Accept and electronically verify Personal Identity Verification-compliant credentials.
Discussion
Acceptance of Personal Identity Verification (PIV)-compliant credentials applies to organizations implementing logical access control and physical access control systems. PIV-compliant credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. The adequacy and reliability of PIV card issuers are authorized using [SP 800-79-2](#10963761-58fc-4b20-b3d6-b44a54daba03) . Acceptance of PIV-compliant credentials includes derived PIV credentials, the use of which is addressed in [SP 800-166](#e8552d48-cf41-40aa-8b06-f45f7fb4706c) . The DOD Common Access Card (CAC) is an example of a PIV credential.
Assessment Objective
Personal Identity Verification-compliant credentials are accepted and electronically verified.
Assessment Method
Examine
Identification and authentication policy
system security plan
procedures addressing user identification and authentication
system design documentation
system configuration settings and associated documentation
system audit records
PIV verification records
evidence of PIV credentials
PIV credential authorizations
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|