NIST-IA-5 Authenticator Management

Manage system authenticators by: a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator; b. Establishing initial authenticator content for any authenticators issued by the organization; c. Ensuring that authenticators have sufficient strength of mechanism for their intended use; d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators; e. Changing default authenticators prior to first use; f. Changing or refreshing authenticators [Assignment: time period by authenticator type] or when [Assignment: events] occur; g. Protecting authenticator content from unauthorized disclosure and modification; h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and i. Changing authenticators for group or role accounts when membership to those accounts changes.

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control [PL-4](#pl-4) or [PS-6](#ps-6) for authenticators in the possession of individuals and by controls [AC-3](#ac-3), [AC-6](#ac-6) , and [SC-28](#sc-28) for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges. Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.004 SSH • T1021.007 Cloud Services • T1021.008 Direct Cloud VM Connections • T1040 Network Sniffing • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.002 Domain Accounts • T1078.004 Cloud Accounts • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.004 SSH Authorized Keys • T1098.006 Additional Container Cluster Roles • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1111 Multi-Factor Authentication Interception • T1114 Email Collection • T1114.002 Remote Email Collection • T1133 External Remote Services • T1136 Create Account • T1136.001 Local Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1212 Exploitation for Credential Access • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1539 Steal Web Session Cookie • T1550.003 Pass the Ticket • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.002 Credentials in Registry • T1552.004 Private Keys • T1552.006 Group Policy Preferences • T1555 Credentials from Password Stores • T1555.001 Keychain • T1555.002 Securityd Memory • T1555.004 Windows Credential Manager • T1555.005 Password Managers • T1556 Modify Authentication Process • T1556.001 Domain Controller Authentication • T1556.003 Pluggable Authentication Modules • T1556.004 Network Device Authentication • T1556.005 Reversible Encryption • T1556.009 Conditional Access Policies • T1558 Steal or Forge Kerberos Tickets • T1558.001 Golden Ticket • T1558.002 Silver Ticket • T1558.003 Kerberoasting • T1558.004 AS-REP Roasting • T1558.005 Ccache Files • T1563.001 SSH Hijacking • T1599 Network Boundary Bridging • T1599.001 Network Address Translation Traversal • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image • T1621 Multi-Factor Authentication Request Generation • T1649 Steal or Forge Authentication Certificates