Identification and Authentication
The Identification and Authentication family in NIST 800-171 Rev 2 focuses on ensuring that information systems can correctly identify and authenticate users, devices, and processes before granting access to systems and data, particularly Controlled Unclassified Information (CUI). This family helps protect against unauthorized access by verifying that only legitimate users or systems can access information resources.
Key Identification and Authentication Requirements in NIST 800-171 Rev 2:
There are seven security requirements in this family. These requirements are designed to control access to systems by requiring users and devices to prove their identity, using mechanisms such as usernames, passwords, multi-factor authentication (MFA), and cryptographic techniques.
1. Identify and Authenticate Organizational Users (3.5.1):
Basic Requirement: Organizations must uniquely identify and authenticate users who need access to the information system. This means that each user should have a unique account or ID, and they must provide valid credentials (such as passwords, biometrics, or tokens) to access the system.
Key Focus:
- Ensure that each user has their own unique credentials (e.g., username and password) to maintain accountability and traceability.
- Implement robust authentication mechanisms, such as passwords or biometric authentication, to verify users’ identities.
Example: Requiring each employee to log in using a unique username and password before accessing the system.
2. Use of Multifactor Authentication (3.5.3):
Derived Requirement: Organizations must implement multifactor authentication (MFA) for users accessing information systems where necessary. MFA requires users to provide at least two types of authentication factors before gaining access, such as something they know (a password), something they have (a token or phone), or something they are (biometrics).
Key Focus:
- Use MFA to strengthen security for system access, especially for privileged accounts or remote access.
- MFA is particularly effective in protecting against stolen credentials, as attackers would need access to multiple forms of authentication.
Example: Requiring employees to use both a password and a one-time code sent to their phone when logging in remotely.
3. Identify and Authenticate Non-Organizational Users (3.5.2):
Derived Requirement: If non-organizational users (e.g., external contractors, temporary staff, or vendors) are allowed access to the system, organizations must ensure they are also uniquely identified and authenticated.
Key Focus:
- Ensure that external users have unique accounts, and apply the same or stricter authentication mechanisms as internal users.
- Limit access for non-organizational users to only the systems and data they need to perform their tasks.
Example: Providing unique credentials for third-party contractors and using MFA for their access to the organization’s systems.
4. Manage Authentication for Devices (3.5.7):
Derived Requirement: Organizations must authenticate and verify the identity of devices that connect to the information system.
This includes ensuring that devices (e.g., workstations, mobile phones, or IoT devices) connecting to the network are authorized and trusted.
Key Focus:
- Use device authentication methods such as certificates or cryptographic keys to verify that only trusted devices can connect to the network.
Example: Requiring devices to have valid security certificates before connecting to the organization's VPN or internal network.
5. Encrypt Authentication Information (3.5.4):
Derived Requirement: Authentication information (such as passwords, tokens, or biometric data) must be encrypted when transmitted across the network to protect it from interception and unauthorized access.
Key Focus:
Ensure that authentication data, including passwords and other credentials, is protected using encryption during transmission and storage.
Example: Using SSL/TLS encryption to secure login pages and protect credentials as they are transmitted over the internet.
6. Prevent Reuse of Identifiers (3.5.5):
Derived Requirement: Organizations must prevent the reuse of user or device identifiers (e.g., usernames or system IDs) within a defined period to maintain security and prevent confusion between different accounts.
Key Focus:
- Ensure that once a user or device ID is deactivated, it cannot be reused for a certain amount of time to prevent conflicts or impersonation.
Example: If an employee’s account is deactivated, their username should not be reassigned to another individual for at least a specified period.
7. Disable Inactive Identifiers (3.5.6):
Derived Requirement: Inactive identifiers (user accounts or device credentials) must be disabled after a defined period of inactivity to prevent unauthorized access.
Key Focus:
- Automatically disable or lock user accounts that have not been used for a certain period (e.g., 30 or 60 days) to reduce the risk of these accounts being compromised.
- This applies to both internal users and non-organizational users.
Example: Automatically disabling employee accounts after 90 days of inactivity, with a process to reactivate the account when needed.
Importance of Identification and Authentication in Cybersecurity:
Access Control: Proper identification and authentication mechanisms are crucial for controlling access to information systems and sensitive data like CUI. They ensure that only authorized users and devices can gain access, reducing the risk of unauthorized access or data breaches.
Accountability: By assigning unique identifiers to each user and device, organizations can track and monitor activities within their systems. This ensures that actions can be traced back to specific individuals or devices, which is essential for auditing and accountability.
Mitigation of Credential-Based Attacks: Strong authentication methods, particularly multifactor authentication (MFA), help mitigate risks such as phishing, password cracking, and credential theft by requiring multiple forms of verification.
Regulatory Compliance: Identification and authentication controls are key components of meeting regulatory requirements, such as NIST 800-171, that govern the protection of CUI. These controls help ensure that access to sensitive data is properly restricted and monitored.
Best Practices for Identification and Authentication:
Implement Multi-Factor Authentication (MFA): Use MFA wherever possible, especially for privileged accounts, remote access, and systems handling sensitive data. MFA provides an additional layer of security beyond just passwords.
Use Strong Password Policies: Enforce strong password policies that require complex passwords, regular password changes, and prevent the reuse of old passwords.
Secure Transmission of Authentication Data: Use encryption (e.g., SSL/TLS) to protect authentication data as it is transmitted across networks, ensuring that credentials cannot be intercepted by attackers.
Monitor and Review User Access: Regularly review user accounts and permissions to ensure that access is appropriate and aligned with job responsibilities. Disable or remove accounts that are no longer needed or have been inactive for an extended period.
Authenticate Devices: Ensure that devices connecting to the network are trusted and secure by using methods such as device certificates or cryptographic keys to authenticate devices before granting access.
Enforce Account Lockout Policies: Implement account lockout policies that temporarily disable accounts after a defined number of failed login attempts to protect against brute-force attacks.
Summary:
The Identification and Authentication family in NIST 800-171 Rev 2 focuses on ensuring that users and devices are properly identified and authenticated before accessing information systems and Controlled Unclassified Information (CUI). These controls help protect against unauthorized access, improve accountability, and reduce the risk of credential-based attacks. By implementing strong identification and authentication mechanisms, including multifactor authentication and device authentication, organizations can ensure the security and integrity of their systems and sensitive data.