+IA-13(01) Protection of Cryptographic Keys
|
IA-13(01) Protection of Cryptographic Keys
Control
Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.
Discussion
Identity assertions and access tokens are typically digitally signed. The private keys used to sign these assertions and tokens are protected commensurate with the impact of the system and information resources that can be accessed.
Assessment Objective
- cryptographic keys that protect access tokens are generated;
- cryptographic keys that protect access tokens are managed;
- cryptographic keys that protect access tokens are protected from disclosure; and
- cryptographic keys that protect access tokens are protected from disclosure and misuse
Assessment Method
Examine
Identification and authentication policy;
procedures addressing cryptographic key establishment and management;
system design documentation;
cryptographic mechanisms;
system configuration settings and associated documentation;
system security plan;
other relevant documents or records
Interview
System/network administrators;
organizational personnel with information security responsibilities;
organizational personnel with responsibilities for cryptographic key establishment and/or management
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|