11.6.2 For that purpose, the relevant entities shall: (a) ensure the strength of authentication is …

Requirement

For that purpose, the relevant entities shall: (a) ensure the strength of authentication is appropriate to the classification of the asset to be accessed; (b) control the allocation to users and management of secret authentication information by a process that ensures the confidentiality of the information, including advising personnel on appropriate handling of authentication information; (c) require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised; (d) require the reset of authentication credentials and the blocking of users after a predefined number of unsuccessful log-in attempts; (e) terminate inactive sessions after a predefined period of inactivity; and (f) require separate credentials to access privileged access or administrative accounts.

Guidance

• Use unique authentication credentials for all the entity’s assets. Best-practice implementation includes, as a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA.
• Consider that the allocation and management process for authentication information should ensure that:
  • passwords or PINs generated automatically during enrolment processes as temporary secret authentication information are non-guessable and unique for each user; and that users are required to change them after the first use;
  • procedures are established to verify the identity of a user prior to providing new, replacement or temporary authentication information;
  • authentication information, including temporary authentication information, is transmitted to users in a secure manner (e.g. via an authenticated and protected channel), and the use of unprotected (clear text) electronic mail messages is avoided;
  • users acknowledge receipt of authentication information;
  • default authentication information as predefined or provided by suppliers is changed immediately following installation of systems or software;
  • records of significant events concerning allocation and management of authentication information are kept and their confidentiality granted, and that the record keeping method is approved (e.g. using an approved password vault tool).
• When passwords are used as authentication information, the password management system should:
  • allow users to select and change their own passwords and include a confirmation procedure to address input errors;
  • enforce strong passwords (96);
  • force users to change their passwords at first login, if relevant;
  • enforce password changes as necessary, for example after a security incident or upon termination or change of employment when a user has known passwords for identities that remain active (e.g. shared identities);
  • prevent the use of commonly used passwords, and compromised combinations of usernames and password from hacked systems;
  • not display passwords on the screen when they are being entered; and
  • store and transmit passwords in protected form.
• The use of phishing-resistant MFA is recommended. Below is a list of currently available solutions ordered from strongest to weakest.
  • ‘Strong’:
    • phishing-resistant:
      • no shared secrets, not vulnerable to attacker-in-the-middle;
      • protected cryptographic private key that can be securely registered to:
        • a domain, in accordance with Fast Identity Online (FIDO) and W3C WebAuthn standards;
        • a trust provider, following public key infrastructure and International Telecommunication Union X.509 standards.
  • ‘Medium’ MFA, for example:
    • push notification, number matching or application based.
  • ‘Last resort’ MFA, for example:
    • text message or email OTP.
• Perform password encryption and hashing in accordance with approved cryptographic techniques for passwords (section 9.2).
• Generate an alert when a potential attempted or successful breach of login controls is detected.

Examples of evidence

• Logs or reports related to authentication.
• Compliance audits from internal or external audits verifying that the management of identities aligns with the policy and regulatory requirements.
• Documentation showing that the identities are reviewed regularly and updated as necessary.
• Records of changes to identities, reflecting any alterations due to role changes or termination of employment.

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

3. Susiję teisės aktai

Susietos užduotys

• ENISA -