KSI-IAM-APM Adopting Passwordless Methods

Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.

NIST SP 800-53 Rev. 5 controls: AC-2, AC-3, IA-2, IA-2(1), IA-2(2), IA-2(6), IA-2(8), IA-5, IA-5(1), IA-5(2), IA-5(6), IA-5(8), IA-6, IA-8, IA-8(2), IA-8(4), SC-23

1. Overview

1.1 References

• FRC-CLA-MFR Mandatory FedRAMP Rules for Class A
• AC-02 Account Management
• AC-03 Access Enforcement
• IA-02 Identification and Authentication (Organizational Users)
• IA-02(01) Multi-factor Authentication to Privileged Accounts
• IA-02(02) Multi-factor Authentication to Non-privileged Accounts
• IA-02(06) Access to Accounts —separate Device
• IA-02(08) Access to Accounts — Replay Resistant
• IA-05 Authenticator Management
• IA-05(01) Password-based Authentication
• IA-05(02) Public Key-based Authentication
• IA-05(06) Protection of Authenticators
• IA-05(08) Multiple System Accounts
• IA-06 Authentication Feedback
• IA-08 Identification and Authentication (Non-organizational Users)
• IA-08(02) Acceptance of External Authenticators
• IA-08(04) Use of Defined Profiles
• SC-23 Session Authenticity

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.