03.05.03E Device Attestation

Statement

Handle device identification and authentication based on attestation by {{ insert: param, A.03.05.03E.ODP.01 }}.

Guidance

Device attestation refers to the identification and authentication of a device based on its configuration and known operating state. Device attestation can be determined via a cryptographic hash of the device. If device attestation is the means of identification and authentication, then it is important that patches and updates to the device are handled via a configuration management process such that the patches and updates are done securely and do not disrupt identification and authentication to other devices. This requirement enhances SP 800-171 requirement 03.05.02.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

device identification and authentication are handled based on attestation by {{ insert: param, A.03.05.03E.ODP.01 }}.

Assessment method

• Identification and authentication policy system security plan procedures addressing device identification and authentication procedures addressing device configuration management system design documentation system configuration settings and associated documentation configuration management records change control records system audit records other relevant documents or records

Assessment method

• Personnel with operational responsibilities for device identification and authentication personnel with information security responsibilities system/network administrators

Assessment method

• Mechanisms supporting and/or implementing device identification and authentication capabilities mechanisms supporting and/or implementing configuration management cryptographic mechanisms supporting device attestation

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final