3.5.3 Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts

By wnoble2005@gmail.com (William Noble) 📅 2024-03-01

NIST 800-171 control 3.5.3 mandates multi-factor authentication (MFA) for user logins. This strengthens access control by requiring more than just a password. It reduces the risk of breaches for both high-level (privileged) and regular accounts. MFA implementation involves using methods like security tokens, biometrics, or even answering challenge questions alongside passwords. Organizations may need to integrate MFA with existing login systems.

Multifactor authentication requires the use of two or more different factors to authenticate. The factors are defined as something you know (e.g., password, personal identification number [PIN]); something you have (e.g., cryptographic identification device, token); or something you are (e.g., biometric). Multifactor authentication solutions that feature physical authenticators include hardware authenticators providing time-based or challenge-response authenticators and smart cards. In addition to authenticating users at the system level (i.e., at logon), organizations may also employ authentication mechanisms at the application level, when necessary, to provide increased information security.Access to organizational systems is defined as local access or network access. Local access is any access to organizational systems by users (or processes acting on behalf of users) where such access is obtained by direct connections without the use of networks. Network access is access to systems by users (or processes acting on behalf of users) where such access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. The use of encrypted virtual private networks for connections between organization-controlled and non-organization controlled endpoints may be treated as internal networks with regard to protecting the confidentiality of information.[SP 800-63-3] provides guidance on digital identities.

Benefits:

Enhanced Security: MFA makes it much harder for attackers to gain access. Even with a stolen password, they'd still need the second factor (e.g., a code from your phone) to log in.

Reduced Risk for Privileged Accounts: MFA is especially crucial for privileged accounts with high access levels. A compromised privileged account can wreak havoc on a system.

Improved User Experience: Modern MFA solutions can be convenient, using methods like fingerprint scanners or phone apps. This reduces user frustration with complex passwords.

Accountability:

Senior Management: They set the security tone and allocate resources. They're accountable for ensuring the organization implements MFA and prioritizes cybersecurity. This could involve budget allocation for MFA solutions, training programs, and disciplinary actions for non-compliance.

IT Security Team: They implement and manage the MFA system. Their accountability lies in selecting a robust MFA solution, integrating it with existing systems, and ensuring user education and ongoing maintenance. They should monitor MFA usage and address any security gaps.

System Owners: They're responsible for specific systems and data. Their accountability involves enforcing MFA usage for their systems, identifying user access needs, and configuring MFA appropriately. They should work with the IT security team for seamless integration.

Individual Users: They're accountable for using MFA properly. This includes registering their MFA devices, keeping them secure, and reporting any suspicious activity related to their accounts. Training should be provided to educate users on the importance and proper use of MFA.

Implementation:

Identify Requirements: Organizations need to assess their needs and choose appropriate MFA solutions for different types of accounts (privileged vs non-privileged) and access methods (local vs network).

MFA Selection: There are various MFA options like software tokens, hardware tokens, and biometrics. Consider ease of use, security strength, and integration with existing systems.

Deployment and Training: MFA needs to be deployed on all relevant systems and users need proper training. This ensures smooth adoption and minimizes disruptions.

Go to docs.google.com

☰

Back

About "3.5.3 Use multifactor aut...ounts" 🡃

Category:Cybersecurity Maturity Model
Family:Identification and Authentication (AC 3.5)
Type:Derived Security Requirements

#CybersecurityMaturityModel #DerivedSecurityRequirements

⬅ Back to 3.5 IDENTIFICATION AND AUTHENTICATION

3.5 IDENTIFICATION AND AUTHENTICATION

3.5.3 Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts

Benefits:

Accountability:

Implementation:

More on q4q.com

Q4Q Technical Solutions