ComplianceNIST 800-53 control

NIST-IA-4 Identifier Management

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
IA Identification and Authentication
Control
IA-4
ATT&CK techniques mitigated
36

Control statement

Manage system identifiers by: a. Receiving authorization from [Assignment: personnel or roles] to assign an individual, group, role, service, or device identifier; b. Selecting an identifier that identifies an individual, group, role, service, or device; c. Assigning the identifier to the intended individual, group, role, service, or device; and d. Preventing reuse of identifiers for [Assignment: time period].

Discussion

Common device identifiers include Media Access Control (MAC) addresses, Internet Protocol (IP) addresses, or device-unique token identifiers. The management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the usernames of the system accounts assigned to those individuals. In such instances, the account management activities of [AC-2](#ac-2) use account names provided by [IA-4](#ia-4) . Identifier management also addresses individual identifiers not necessarily associated with system accounts. Preventing the reuse of identifiers implies preventing the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices.

ATT&CK mappings (CTID)

• T1003 OS Credential Dumping • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1021.001 Remote Desktop Protocol • T1021.005 VNC • T1053 Scheduled Task/Job • T1053.002 At • T1053.005 Scheduled Task • T1098.007 Additional Local or Domain Groups • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1543 Create or Modify System Process • T1547.006 Kernel Modules and Extensions • T1550.001 Application Access Token • T1552 Unsecured Credentials • T1552.005 Cloud Instance Metadata API • T1562 Impair Defenses • T1563 Remote Service Session Hijacking • T1578 Modify Cloud Compute Infrastructure • T1578.001 Create Snapshot • T1578.002 Create Cloud Instance • T1578.003 Delete Cloud Instance • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump

Related

Mitigates · not in database (1)

Mitigates · MITRE ATT&CK (35)

  • T1213.005 Messaging Applications sub-technique
  • T1098.007 Additional Local or Domain Groups sub-technique
  • T1213.004 Customer Relationship Management Software sub-technique
  • T1602.002 Network Device Configuration Dump sub-technique
  • T1602 Data from Configuration Repository technique
  • T1602.001 SNMP (MIB Dump) sub-technique
  • T1578.003 Delete Cloud Instance sub-technique
  • T1578.001 Create Snapshot sub-technique
  • T1578.002 Create Cloud Instance sub-technique
  • T1563 Remote Service Session Hijacking technique
  • T1003.005 Cached Domain Credentials sub-technique
  • T1213.001 Confluence sub-technique
  • T1213.002 Sharepoint sub-technique
  • T1003.006 DCSync sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1021.005 VNC sub-technique
  • T1110.001 Password Guessing sub-technique
  • T1110.002 Password Cracking sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1110.004 Credential Stuffing sub-technique
  • T1552.005 Cloud Instance Metadata API sub-technique
  • T1552 Unsecured Credentials technique
  • T1550.001 Application Access Token sub-technique
  • T1547.006 Kernel Modules and Extensions sub-technique
  • T1543 Create or Modify System Process technique
  • T1053.002 At sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1528 Steal Application Access Token technique
  • T1530 Data from Cloud Storage technique
  • T1537 Transfer Data to Cloud Account technique
Show all 35 ›

Related control · Compliance (17)

  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-IA-12 Identity Proofing NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-IA-9 Service Identification and Authentication NIST 800-53 control
  • NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
  • NIST-PE-2 Physical Access Authorizations NIST 800-53 control
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-PE-4 Access Control for Transmission NIST 800-53 control
  • NIST-PL-4 Rules of Behavior NIST 800-53 control
  • NIST-PM-12 Insider Threat Program NIST 800-53 control
  • NIST-PS-3 Personnel Screening NIST 800-53 control
  • NIST-PS-4 Personnel Termination NIST 800-53 control
  • NIST-PS-5 Personnel Transfer NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control

Referenced by Compliance · enhancement of (6)

  • NIST-IA-4(1) Prohibit Account Identifiers as Public Identifiers NIST 800-53 enhancement
  • NIST-IA-4(4) Identify User Status NIST 800-53 enhancement
  • NIST-IA-4(5) Dynamic Management NIST 800-53 enhancement
  • NIST-IA-4(6) Cross-organization Management NIST 800-53 enhancement
  • NIST-IA-4(8) Pairwise Pseudonymous Identifiers NIST 800-53 enhancement
  • NIST-IA-4(9) Attribute Maintenance and Protection NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-IA Identification and Authentication NIST 800-53 family

Referenced by Compliance · related control (23)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AT-2 Literacy Training and Awareness NIST 800-53 control
  • NIST-AU-16(1) Identity Preservation NIST 800-53 enhancement
  • NIST-IA-11 Re-authentication NIST 800-53 control
  • NIST-IA-12 Identity Proofing NIST 800-53 control
  • NIST-IA-12(6) Accept Externally-proofed Identities NIST 800-53 enhancement
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-IA-9 Service Identification and Authentication NIST 800-53 control
  • NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
  • NIST-PE-2 Physical Access Authorizations NIST 800-53 control
  • NIST-PE-2(2) Two Forms of Identification NIST 800-53 enhancement
  • NIST-PE-4 Access Control for Transmission NIST 800-53 control
  • NIST-PL-4 Rules of Behavior NIST 800-53 control
  • NIST-PM-12 Insider Threat Program NIST 800-53 control
  • NIST-PS-3 Personnel Screening NIST 800-53 control
  • NIST-PS-4 Personnel Termination NIST 800-53 control
  • NIST-PS-5 Personnel Transfer NIST 800-53 control
  • NIST-PT-7(1) Social Security Numbers NIST 800-53 enhancement
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control