Assessment Objective
Determine if:
- replay-resistant authentication mechanisms for access to privileged accounts are implemented.
- replay-resistant authentication mechanisms for access to non-privileged accounts are implemented.
Assessment Methods
Examine
- identification and authentication policy and procedures
- system design documentation
- system audit records
- system configuration settings
- list of privileged system accounts
- system security plan
- other relevant documents or records
Interview
- personnel with system operations responsibilities
- personnel with account management responsibilities
- personnel with information security responsibilities
- system developers
- system administrators
Test
- mechanisms for supporting or implementing identification and authentication capabilities
- mechanisms for supporting or implementing replay-resistance
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | 03.05.04 Replay-Resistant Authentication |