8.5 Secure authentication
Requires secure authentication technologies and procedures to be implemented, driven by the information access restrictions and the topic specific policy on access control.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration evidence per system showing the enforced authentication, including multi factor coverage and the factors accepted · Identity provider / directory
- Session management configuration, covering timeout, re-authentication for sensitive actions and secure token handling · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence of protection against brute force and credential stuffing, such as lockout, rate limiting and anomaly detection · Identity provider / directory
governing documentDocuments that govern the control
- The authentication standard, setting required methods against the sensitivity of the information and the access route · Policy repository / GRC workspace
- Records of exceptions where the standard is not met, with approval and compensating measures · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Multi factor authentication enforced for the corporate identity provider while legacy protocols and direct application logins bypass it
- Exceptions granted for convenience to senior or technical staff, which are the accounts most worth attacking
- Service and machine accounts excluded with no compensating restriction on where they can authenticate from
- Coverage claimed at the platform level with no per application verification
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet