11.6 Authentication

Requirement

The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.

Guidance

• Authentication technologies are methods used to verify the identity of users, devices or systems before granting access to resources. Here are some common authentication technologies (indicative, non-exhaustive list):
  • password-based authentication,
  • passkeys,
  • two-factor authentication,
  • MFA (95),
  • biometric authentication,
  • token-based authentication, such as a one-time passcode (OTP),
  • smart cards,
  • Fast Identity Online 2 security keys,
  • certificate-based authentication,
  • SSO,
  • OpenID Connect.

Examples of evidence

• Access control policy documents outlining secure authentication procedures and technologies.
• Logs from authentication systems showing successful and failed authentication attempts, which demonstrate secure implementation.
• Evidence of the systems in place that enforce access controls, such as IAM solutions.
• Internal or external audit reports verifying the implementation of secure authentication procedures aligned with the access control policy.
• Documentation that shows the use of secure authentication and authorization protocols and demonstrates that these have been tested to confirm that they are implemented in a secure fashion.

Requirement

For that purpose, the relevant entities shall: (a) ensure the strength of authentication is appropriate to the classification of the asset to be accessed; (b) control the allocation to users and management of secret authentication information by a process that ensures the confidentiality of the information, including advising personnel on appropriate handling of authentication information; (c) require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised; (d) require the reset of authentication credentials and the blocking of users after a predefined number of unsuccessful log-in attempts; (e) terminate inactive sessions after a predefined period of inactivity; and (f) require separate credentials to access privileged access or administrative accounts.

Guidance

• Use unique authentication credentials for all the entity’s assets. Best-practice implementation includes, as a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA.
• Consider that the allocation and management process for authentication information should ensure that:
  • passwords or PINs generated automatically during enrolment processes as temporary secret authentication information are non-guessable and unique for each user; and that users are required to change them after the first use;
  • procedures are established to verify the identity of a user prior to providing new, replacement or temporary authentication information;
  • authentication information, including temporary authentication information, is transmitted to users in a secure manner (e.g. via an authenticated and protected channel), and the use of unprotected (clear text) electronic mail messages is avoided;
  • users acknowledge receipt of authentication information;
  • default authentication information as predefined or provided by suppliers is changed immediately following installation of systems or software;
  • records of significant events concerning allocation and management of authentication information are kept and their confidentiality granted, and that the record keeping method is approved (e.g. using an approved password vault tool).
• When passwords are used as authentication information, the password management system should:
  • allow users to select and change their own passwords and include a confirmation procedure to address input errors;
  • enforce strong passwords (96);
  • force users to change their passwords at first login, if relevant;
  • enforce password changes as necessary, for example after a security incident or upon termination or change of employment when a user has known passwords for identities that remain active (e.g. shared identities);
  • prevent the use of commonly used passwords, and compromised combinations of usernames and password from hacked systems;
  • not display passwords on the screen when they are being entered; and
  • store and transmit passwords in protected form.
• The use of phishing-resistant MFA is recommended. Below is a list of currently available solutions ordered from strongest to weakest.
  • ‘Strong’:
    • phishing-resistant:
      • no shared secrets, not vulnerable to attacker-in-the-middle;
      • protected cryptographic private key that can be securely registered to:
        • a domain, in accordance with Fast Identity Online (FIDO) and W3C WebAuthn standards;
        • a trust provider, following public key infrastructure and International Telecommunication Union X.509 standards.
  • ‘Medium’ MFA, for example:
    • push notification, number matching or application based.
  • ‘Last resort’ MFA, for example:
    • text message or email OTP.
• Perform password encryption and hashing in accordance with approved cryptographic techniques for passwords (section 9.2).
• Generate an alert when a potential attempted or successful breach of login controls is detected.

Examples of evidence

• Logs or reports related to authentication.
• Compliance audits from internal or external audits verifying that the management of identities aligns with the policy and regulatory requirements.
• Documentation showing that the identities are reviewed regularly and updated as necessary.
• Records of changes to identities, reflecting any alterations due to role changes or termination of employment.

Requirement

The relevant entities shall to the extent feasible use state-of-the-art authentication methods, in accordance with the associated assessed risk and the classification of the asset to be accessed and unique authentication information.

Guidance

• Adjust authentication methods based on the associated assessed risk. For example, require additional authentication for high-risk transactions or access to assets of higher criticality.
• Use more stringent authentication methods for assets of higher criticality.
• Ensure each user has unique credentials. Avoid shared accounts and implement strict policies for credential management.

Examples of evidence

• Access control policy documents outlining secure authentication procedures and technologies.

Requirement

The relevant entities shall regularly review the authentication procedures and technologies at planned intervals.

Guidance

• Conduct periodic audits of authentication procedures and technologies to ensure they remain up to date, where appropriate and effective against emerging threats.
• Stay up to date on advancements in authentication technology and integrate new methods as they become available.

Examples of evidence

• Internal or external audit reports detailing the results of periodic audits of authentication procedures and technologies.
• Logs showing the implementation of new authentication technologies and methods as they become available

Tips: guidance

• Advise any user with access to or using authentication information to comply with the following.
  • Secret authentication information, such as passwords, is kept confidential. Personal secret authentication information is not to be shared with anyone. Secret authentication information used in the context of identities linked to multiple users or linked to non-personal entities is solely shared with authorised persons.
  • Affected or compromised authentication information is changed immediately upon notification of or any other indication of a compromise.
  • When passwords are used as authentication information, strong passwords according to best practice recommendations are selected. For example, passwords are not based on anything somebody else can easily guess or obtain using person-related information (e.g. names, telephone numbers and dates of birth); passwords are not based on dictionary words or combinations thereof; use easy to remember passphrases and try to include alphanumerical and special characters; passwords should have a minimum length.
  • The same credentials are not used across different network and information systems.
  • The obligation to follow these rules is also included in the terms and conditions of employment.

Tips: examples of evidence

• Documentation of training sessions for employees on secure authentication practices and technologies.
• Records of awareness programmes or communications to employees about the importance of secure authentication.