03.05.04E No Embedded Unencrypted Static Authenticators

Statement

Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.

Guidance

In addition to applications, other forms of static storage include access scripts and function keys. Organizations exercise caution when determining whether embedded or stored authenticators are encrypted or unencrypted. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators. This requirement enhances SP 800-171 requirement 03.05.07.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

unencrypted static authenticators are not embedded in applications or other forms of static storage.

Assessment method

• Identification and authentication policy system security plan procedures addressing authenticator management system design documentation system configuration settings and associated documentation logical access scripts application code reviews for detecting unencrypted static authenticators other relevant documents or records

Assessment method

• Personnel with authenticator management responsibilities personnel with information security responsibilities system/network administrators system developers

Assessment method

• Mechanisms supporting and/or implementing authenticator management capabilities mechanisms implementing authentication in applications

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final