03.05 Identification and Authentication

Statement

• a. Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users.

• b. Re-authenticate users when {{ insert: param, A.03.05.01.ODP.01 }} .

Guidance

System users include individuals (or system processes acting on behalf of individuals) who are authorized to access a system. Typically, individual identifiers are the usernames associated with the system accounts assigned to those individuals. Since system processes execute on behalf of groups and roles, organizations may require the unique identification of individuals in group accounts or the accountability of individual activity. The unique identification and authentication of users apply to all system accesses. Organizations use passwords, physical authenticators, biometrics, or some combination thereof to authenticate user identities. Organizations may re-authenticate individuals in certain situations, including when roles, authenticators, or credentials change; when the execution of privileged functions occurs; after a fixed time period; or periodically.

Assessment objective

system users are uniquely identified.

Assessment objective

system users are authenticated.

Assessment objective

processes acting on behalf of users are associated with uniquely identified and authenticated system users.

Assessment objective

users are reauthenticated when {{ insert: param, A.03.05.01.ODP.01 }} .

Assessment method

• identification and authentication policy and procedures list of circumstances or situations requiring re-authentication system design documentation system configuration settings system audit records list of system accounts system security plan other relevant documents or records

Assessment method

• personnel with identification and authentication responsibilities personnel with system operations responsibilities personnel with account management responsibilities system developers personnel with information security responsibilities system administrators

Assessment method

• processes for uniquely identifying and authenticating users mechanisms for supporting or implementing identification and authentication capabilities

Statement

Uniquely identify and authenticate {{ insert: param, A.03.05.02.ODP.01 }} before establishing a system connection.

Guidance

Devices that require unique device-to-device identification and authentication are defined by type, device, or a combination of type and device. Organization-defined device types include devices that are not owned by the organization. Systems use shared known information (e.g., Media Access Control .MAC, Transmission Control Protocol/Internet Protocol .TCP/IP addresses) for device identification or organizational authentication solutions (e.g., Institute of Electrical and Electronics Engineers .IEEE 802.1x and Extensible Authentication Protocol .EAP, RADIUS server with EAP-Transport Layer Security .TLS authentication, Kerberos) to identify and authenticate devices on local and wide area networks. Public Key Infrastructure (PKI) and certificate revocation checking for the certificates exchanged can be included as part of device authentication.

Assessment objective

{{ insert: param, A.03.05.02.ODP.01 }} are authenticated before establishing a system connection.

Assessment objective

{{ insert: param, A.03.05.02.ODP.01 }} are uniquely identified before establishing a system connection.

Assessment method

• identification and authentication policy and procedures procedures for device identification and authentication system design documentation list of devices requiring unique identification and authentication device connection reports system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for device identification and authentication personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing device identification and authentication capabilities

Statement

Implement multi-factor authentication for access to privileged and non-privileged accounts.

Guidance

This requirement applies to user accounts. Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number .PIN), something you have (e.g., a physical authenticator, such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards. In addition to authenticating users at the system level, organizations may also employ authentication mechanisms at the application level to provide increased information security.

Assessment objective

multi-factor authentication for access to privileged accounts is implemented.

Assessment objective

multi-factor authentication for access to non-privileged accounts is implemented.

Assessment method

• identification and authentication policy and procedures system design documentation list of system accounts system configuration settings system audit records system security plan other relevant documents or records

Assessment method

• personnel with system operations responsibilities personnel with account management responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing a multi-factor authentication capability

Statement

Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.

Guidance

Authentication processes resist replay attacks if it is impractical to successfully authenticate by recording or replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges, such as time synchronous or challenge-response one-time authenticators.

Assessment objective

replay-resistant authentication mechanisms for access to privileged accounts are implemented.

Assessment objective

replay-resistant authentication mechanisms for access to non-privileged accounts are implemented.

Assessment method

• identification and authentication policy and procedures system design documentation system audit records system configuration settings list of privileged system accounts system security plan other relevant documents or records

Assessment method

• personnel with system operations responsibilities personnel with account management responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing identification and authentication capabilities mechanisms for supporting or implementing replay-resistance

Statement

• a. Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier.

• b. Select and assign an identifier that identifies an individual, group, role, service, or device.

• c. Prevent the reuse of identifiers for {{ insert: param, A.03.05.05.ODP.01 }}.

• d. Manage individual identifiers by uniquely identifying each individual as {{ insert: param, A.03.05.05.ODP.02 }}.

Guidance

Identifiers are provided for users, processes acting on behalf of users, and devices. Prohibiting the reuse of identifiers prevents the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices. Characteristics that identify the status of individuals include contractors, foreign nationals, and non-organizational users. Identifying the status of individuals by these characteristics provides information about the people with whom organizational personnel are communicating. For example, it is useful for an employee to know that one of the individuals on an email message is a contractor.

Assessment objective

authorization is received from organizational personnel or roles to assign an individual, group, role, service, or device identifier.

Assessment objective

an identifier that identifies an individual, group, role, service, or device is selected.

Assessment objective

an identifier that identifies an individual, group, role, service, or device is assigned.

Assessment objective

the reuse of identifiers for {{ insert: param, A.03.05.05.ODP.01 }} is prevented.

Assessment objective

individual identifiers are managed by uniquely identifying each individual as {{ insert: param, A.03.05.05.ODP.02 }}.

Assessment method

• identification and authentication policy and procedures procedures for identifier management procedures for account management system design documentation list of system accounts list of characteristics identifying individual status system configuration settings list of identifiers generated from physical access control devices system security plan other relevant documents or records

Assessment method

• personnel with identifier management responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing identifier management

Statement

• a. Maintain a list of commonly-used, expected, or compromised passwords, and update the list {{ insert: param, A.03.05.07.ODP.01 }} and when organizational passwords are suspected to have been compromised.

• b. Verify that passwords are not found on the list of commonly used, expected, or compromised passwords when users create or update passwords.

• c. Transmit passwords only over cryptographically protected channels.

• d. Store passwords in a cryptographically protected form.

• e. Select a new password upon first use after account recovery.

• f. Enforce the following composition and complexity rules for passwords: {{ insert: param, A.03.05.07.ODP.02 }}.

Guidance

Password-based authentication applies to passwords used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable to shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish and enforce certain rules for password generation (e.g., minimum character length) under certain circumstances. For example, account recovery can occur when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof. Changing temporary passwords to permanent passwords immediately after system logon ensures that the necessary strength of the authentication mechanism is implemented at the earliest opportunity and reduces susceptibility to authenticator compromises. Long passwords and passphrases can be used to increase the complexity of passwords.

Assessment objective

a list of commonly used, expected, or compromised passwords is maintained.

Assessment objective

a list of commonly used, expected, or compromised passwords is updated {{ insert: param, A.03.05.07.ODP.01 }}.

Assessment objective

a list of commonly used, expected, or compromised passwords is updated when organizational passwords are suspected to have been compromised.

Assessment objective

passwords are verified not to be found on the list of commonly used, expected, or compromised passwords when they are created or updated by users.

Assessment objective

passwords are only transmitted over cryptographically protected channels.

Assessment objective

passwords are stored in a cryptographically protected form.

Assessment objective

a new password is selected upon first use after account recovery.

Assessment objective

the following composition and complexity rules for passwords are enforced: {{ insert: param, A.03.05.07.ODP.02 }}.

Assessment method

• identification and authentication policy and procedures password policy procedures for authenticator management system design documentation system configuration settings password configurations system security plan other relevant documents or records

Assessment method

• personnel with authenticator management responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing a password-based authenticator management capability

Statement

Obscure feedback of authentication information during the authentication process.

Guidance

Authentication feedback does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For example, for desktop or notebook systems with relatively large monitors, the threat may be significant (commonly referred to as shoulder surfing). For mobile devices with small displays, this threat may be less significant and is balanced against the increased likelihood of input errors due to small keyboards. Therefore, the means of obscuring authenticator feedback is selected accordingly. Obscuring feedback includes displaying asterisks when users type passwords into input devices or displaying feedback for a limited time before fully obscuring it.

Assessment objective

feedback of authentication information during the authentication process is obscured.

Assessment method

• identification and authentication policy and procedures procedures for authenticator feedback system design documentation system configuration settings system audit records system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing the obscuring of feedback of authentication information during authentication

Statement

• a. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution.

• b. Establish initial authenticator content for any authenticators issued by the organization.

• c. Establish and implement administrative procedures for initial authenticator distribution; for lost, compromised, or damaged authenticators; and for revoking authenticators.

• d. Change default authenticators at first use.

• e. Change or refresh authenticators {{ insert: param, A.03.05.12.ODP.01 }} or when the following events occur: {{ insert: param, A.03.05.12.ODP.02 }}.

• f. Protect authenticator content from unauthorized disclosure and modification.

Guidance

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. The initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, requirements for authenticator content contain specific characteristics. Authenticator management is supported by organization-defined settings and restrictions for various authenticator characteristics (e.g., password complexity and composition rules, validation time window for time synchronous one-time tokens, and the number of allowed rejections during the verification stage of biometric authentication). The requirement to protect individual authenticators may be implemented by [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.15.03)03.15.03 for authenticators in the possession of individuals and by [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.01) 03.01.01, [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.02) 03.01.02, [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.05)03.01.05, and [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.08)03.13.08 for authenticators stored in organizational systems. This includes passwords stored in hashed or encrypted formats or files that contain hashed or encrypted passwords that are accessible with administrator privileges. Actions can be taken to protect authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Developers may deliver system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well-known, easily discoverable, and present a significant risk. Authenticator management includes issuing and revoking authenticators for temporary access when they are no longer needed. The use of long passwords or passphrases may obviate the need to periodically change authenticators.

Assessment objective

the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution is verified.

Assessment objective

initial authenticator content for any authenticators issued by the organization is established.

Assessment objective

administrative procedures for initial authenticator distribution are established.

Assessment objective

administrative procedures for lost, compromised, or damaged authenticators are established.

Assessment objective

administrative procedures for revoking authenticators are established.

Assessment objective

administrative procedures for initial authenticator distribution are implemented.

Assessment objective

administrative procedures for lost, compromised, or damaged authenticators are implemented.

Assessment objective

administrative procedures for revoking authenticators are implemented.

Assessment objective

default authenticators are changed at first use.

Assessment objective

authenticators are changed or refreshed {{ insert: param, A.03.05.12.ODP.01 }} or when the following events occur: {{ insert: param, A.03.05.12.ODP.02 }}.

Assessment objective

authenticator content is protected from unauthorized disclosure.

Assessment objective

authenticator content is protected from unauthorized modification.

Assessment method

• identification and authentication policy and procedures procedures for authenticator management system configuration settings list of system authenticator types system design documentation system audit records change control records associated with managing system authenticators system security plan other relevant documents or records

Assessment method

• personnel with authenticator management responsibilities personnel with information security responsibilities system administrators

Assessment method

• mechanisms for supporting or implementing the authenticator management capability