Practice IA.L2-3.5.2 Details - Revision history

David at 00:58, 16 March 2025

2025-03-16T00:58:08Z

← Older revision		Revision as of 00:58, 16 March 2025
Line 15:		Line 15:
	'''Examine'''		'''Examine'''

	[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing authenticator management;procedures addressing user identification and authentication; system design documentation; list of system authenticator types; system configuration settings and associated documentation; change control records associated with managing system authenticators;system audit logs and records;other relevant documents or records].		[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing authenticator management; procedures addressing user identification and authentication; system design documentation; list of system authenticator types; system configuration settings and associated documentation; change control records associated with managing system authenticators; system audit logs and records; other relevant documents or records].

	'''Interview'''		'''Interview'''
Line 25:		Line 25:
	[SELECT FROM: Mechanisms supporting or implementing authenticator management capability].		[SELECT FROM: Mechanisms supporting or implementing authenticator management capability].
	=== DISCUSSION ===		=== DISCUSSION ===
	Individual authenticators include the following: passwords, key cards, cryptographic devices, and one-time password devices. Initial authenticator content is the actual content of the authenticator, for example, the initial password. In contrast, the requirements about authenticator content include the minimum password length.Developers ship system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant security risk.		Individual authenticators include the following: passwords, key cards, cryptographic devices, and one-time password devices. Initial authenticator content is the actual content of the authenticator, for example, the initial password. In contrast, the requirements about authenticator content include the minimum password length. Developers ship system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant security risk.

	Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics including minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication. Authenticator management includes issuing and revoking, when no longer needed, authenticators for temporary access such as that required for remote maintenance. Device authenticators include certificates and passwords.		Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics including minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication. Authenticator management includes issuing and revoking, when no longer needed, authenticators for temporary access such as that required for remote maintenance. Device authenticators include certificates and passwords.
Line 32:		Line 32:
	=== FURTHER DISCUSSION ===		=== FURTHER DISCUSSION ===
	Before you let a person or a device have access to your system, verify that the user or device is who or what it claims to be. This verification is called authentication. The most common way to verify identity is using a username and a hard-to-guess password.		Before you let a person or a device have access to your system, verify that the user or device is who or what it claims to be. This verification is called authentication. The most common way to verify identity is using a username and a hard-to-guess password.
	Some devices ship with default usernames and passwords. For example, some devices ship so that when you first log on to the device, the username is “admin” and the password is “admin”.When you have devices with this type of default username and password, immediately change the default password to a unique password you create.Default passwords may be well known to the public, easily found in a search, or easy to guess, allowing an unauthorized person to access your system.		Some devices ship with default usernames and passwords. For example, some devices ship so that when you first log on to the device, the username is “admin” and the password is “admin”. When you have devices with this type of default username and password, immediately change the default password to a unique password you create. Default passwords may be well known to the public, easily found in a search, or easy to guess, allowing an unauthorized person to access your system.

	'''Example 1'''		'''Example 1'''

David at 23:00, 15 March 2025

2025-03-15T23:00:18Z

← Older revision		Revision as of 23:00, 15 March 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://~~www~~.~~acq~~.~~osd.mil~~/cmmc/~~documentation.html~~ CMMC Level ~~1 Self-~~Assessment Guide] from the ~~Office of the Under Secretary~~ of Defense ~~Acquisition & Sustainment~~.'''		'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 2 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== IA.L1-3.5.2 – AUTHENTICATION ==		== IA.L2-3.5.2 – AUTHENTICATION ==
			Level 1 Reference: IA.L1-b.1.vi
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===
	Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.		Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

David: David moved page Practice IA.L1-3.5.2 Details to Practice IA.L2-3.5.2 Details

2025-03-15T22:56:54Z

David moved page Practice IA.L1-3.5.2 Details to Practice IA.L2-3.5.2 Details

← Older revision		Revision as of 22:56, 15 March 2025
(No difference)

Wikiadmin at 18:56, 23 February 2022

2022-02-23T18:56:53Z

← Older revision		Revision as of 18:56, 23 February 2022
Line 47:		Line 47:
	* Are device identifiers used in authentication processes (e.g., MAC address, non-anonymous computer name, certificates) [c]?		* Are device identifiers used in authentication processes (e.g., MAC address, non-anonymous computer name, certificates) [c]?
	=== KEY REFERENCES ===		=== KEY REFERENCES ===
	• FAR Clause 52.204-21 b.1.vi		* FAR Clause 52.204-21 b.1.vi
	• NIST SP 800-171 Rev 2 3.5.2		* NIST SP 800-171 Rev 2 3.5.2

Wikiadmin: Created page with "'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 1 Self-Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == IA.L1-3.5.2 – AUTHENTICATION == === SECURITY REQUIREMENT === Authenticate (or verify) the identities of those users, processes, or devices, as a prerequis..."

2022-02-23T18:56:26Z

Created page with "'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 1 Self-Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == IA.L1-3.5.2 – AUTHENTICATION == === SECURITY REQUIREMENT === Authenticate (or verify) the identities of those users, processes, or devices, as a prerequis..."

New page

'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 1 Self-Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.'''

For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

== IA.L1-3.5.2 – AUTHENTICATION ==
=== SECURITY REQUIREMENT ===
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
=== ASSESSMENT OBJECTIVES ===
Determine if:
: [a] the identity of each user is authenticated or verified as a prerequisite to system access;
: [b] the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and
: [c] the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
'''Examine'''

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing authenticator management;procedures addressing user identification and authentication; system design documentation; list of system authenticator types; system configuration settings and associated documentation; change control records associated with managing system authenticators;system audit logs and records;other relevant documents or records].

'''Interview'''

[SELECT FROM: Personnel with authenticator management responsibilities; personnel with information security responsibilities; system or network administrators].

'''Test'''

[SELECT FROM: Mechanisms supporting or implementing authenticator management capability].
=== DISCUSSION ===
Individual authenticators include the following: passwords, key cards, cryptographic devices, and one-time password devices. Initial authenticator content is the actual content of the authenticator, for example, the initial password. In contrast, the requirements about authenticator content include the minimum password length.Developers ship system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant security risk.

Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics including minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication. Authenticator management includes issuing and revoking, when no longer needed, authenticators for temporary access such as that required for remote maintenance. Device authenticators include certificates and passwords.

NIST SP 800-63-3 provides guidance on digital identities.
=== FURTHER DISCUSSION ===
Before you let a person or a device have access to your system, verify that the user or device is who or what it claims to be. This verification is called authentication. The most common way to verify identity is using a username and a hard-to-guess password.
Some devices ship with default usernames and passwords. For example, some devices ship so that when you first log on to the device, the username is “admin” and the password is “admin”.When you have devices with this type of default username and password, immediately change the default password to a unique password you create.Default passwords may be well known to the public, easily found in a search, or easy to guess, allowing an unauthorized person to access your system.

'''Example 1'''

You are in charge of purchasing. You know that some laptops come with a default username and password. You notify IT that all default passwords should be reset prior to laptop use [a]. You ask IT to explain the importance of resetting default passwords and convey how easily they are discovered using internet searches during next week’s cybersecurity awareness training.

'''Example 2'''

Your company decides to use cloud services for email and other capabilities. Upon reviewing this practice, you realize every user or device that connects to the cloud service must be authenticated. As a result, you work with your cloud service provider to ensure that only properly authenticated users and devices are allowed to connect to the system [a,c].

'''Potential Assessment Considerations'''
* Are unique authenticators used to verify user identities (e.g., passwords) [a]?
* An example of a process acting on behalf of users could be a script that logs in as a person or service account [b]. Can the contractor show that it maintains a record of all of those service accounts for use when reviewing log data or responding to an incident?
* Are user credentials authenticated in system processes (e.g., credentials binding, certificates, tokens) [b]?
* Are device identifiers used in authentication processes (e.g., MAC address, non-anonymous computer name, certificates) [c]?
=== KEY REFERENCES ===
• FAR Clause 52.204-21 b.1.vi
• NIST SP 800-171 Rev 2 3.5.2