+IA-09 Service Identification and Authentication
|
IA-09 Service Identification and Authentication
Control
Uniquely identify and authenticate [Assignement: system services and applications] before establishing communications with devices, users, or other services or applications.
Discussion
Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.
Assessment Objective
[Assignement: system services and applications] are uniquely identified and authenticated before establishing communications with devices, users, or other services or applications.
Assessment Method
Examine
Identification and authentication policy
procedures addressing service identification and authentication
system security plan
system design documentation
security safeguards used to identify and authenticate system services
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
organizational personnel with identification and authentication responsibilities
1. Resumen
1.1 Referencias
1.2 Requisitos identificados
1.3 Regulaciones relacionadas
2. Requisitos identificados
Requisitos
| Fuente |
Requisito |
3. Regulaciones relacionadas
Regulaciones
| Fuente |
Regulación |
Incidencias vinculadas
|