03.05.12 Authenticator Management

Statement

• a. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution.

• b. Establish initial authenticator content for any authenticators issued by the organization.

• c. Establish and implement administrative procedures for initial authenticator distribution; for lost, compromised, or damaged authenticators; and for revoking authenticators.

• d. Change default authenticators at first use.

• e. Change or refresh authenticators {{ insert: param, A.03.05.12.ODP.01 }} or when the following events occur: {{ insert: param, A.03.05.12.ODP.02 }}.

• f. Protect authenticator content from unauthorized disclosure and modification.

Guidance

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. The initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, requirements for authenticator content contain specific characteristics. Authenticator management is supported by organization-defined settings and restrictions for various authenticator characteristics (e.g., password complexity and composition rules, validation time window for time synchronous one-time tokens, and the number of allowed rejections during the verification stage of biometric authentication). The requirement to protect individual authenticators may be implemented by [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.15.03)03.15.03 for authenticators in the possession of individuals and by [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.01) 03.01.01, [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.02) 03.01.02, [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.05)03.01.05, and [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.08)03.13.08 for authenticators stored in organizational systems. This includes passwords stored in hashed or encrypted formats or files that contain hashed or encrypted passwords that are accessible with administrator privileges. Actions can be taken to protect authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Developers may deliver system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well-known, easily discoverable, and present a significant risk. Authenticator management includes issuing and revoking authenticators for temporary access when they are no longer needed. The use of long passwords or passphrases may obviate the need to periodically change authenticators.

Assessment objective

the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution is verified.

Assessment objective

initial authenticator content for any authenticators issued by the organization is established.

Assessment objective

administrative procedures for initial authenticator distribution are established.

Assessment objective

administrative procedures for lost, compromised, or damaged authenticators are established.

Assessment objective

administrative procedures for revoking authenticators are established.

Assessment objective

administrative procedures for initial authenticator distribution are implemented.

Assessment objective

administrative procedures for lost, compromised, or damaged authenticators are implemented.

Assessment objective

administrative procedures for revoking authenticators are implemented.

Assessment objective

default authenticators are changed at first use.

Assessment objective

authenticators are changed or refreshed {{ insert: param, A.03.05.12.ODP.01 }} or when the following events occur: {{ insert: param, A.03.05.12.ODP.02 }}.

Assessment objective

authenticator content is protected from unauthorized disclosure.

Assessment objective

authenticator content is protected from unauthorized modification.

Assessment method

• identification and authentication policy and procedures procedures for authenticator management system configuration settings list of system authenticator types system design documentation system audit records change control records associated with managing system authenticators system security plan other relevant documents or records

Assessment method

• personnel with authenticator management responsibilities personnel with information security responsibilities system administrators

Assessment method

• mechanisms for supporting or implementing the authenticator management capability

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final