+IA-05(10) Dynamic Credential Binding
|
IA-05(10) Dynamic Credential Binding
Control
Bind identities and authenticators dynamically using the following rules: [Assignement: binding rules].
Discussion
Authentication requires some form of binding between an identity and the authenticator that is used to confirm the identity. In conventional approaches, binding is established by pre-provisioning both the identity and the authenticator to the system. For example, the binding between a username (i.e., identity) and a password (i.e., authenticator) is accomplished by provisioning the identity and authenticator as a pair in the system. New authentication techniques allow the binding between the identity and the authenticator to be implemented external to a system. For example, with smartcard credentials, the identity and authenticator are bound together on the smartcard. Using these credentials, systems can authenticate identities that have not been pre-provisioned, dynamically provisioning the identity after authentication. In these situations, organizations can anticipate the dynamic provisioning of identities. Pre-established trust relationships and mechanisms with appropriate authorities to validate identities and related credentials are essential.
Assessment Objective
identities and authenticators are dynamically bound using [Assignement: binding rules].
Assessment Method
Examine
Identification and authentication policy
procedures addressing identifier management
system security plan
system design documentation
automated mechanisms providing dynamic binding of identifiers and authenticators
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with identifier management responsibilities
organizational personnel with information security responsibilities
system/network administrators
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|