ComplianceNIST 800-53 control

NIST-IA-9 Service Identification and Authentication

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
IA Identification and Authentication
Control
IA-9
ATT&CK techniques mitigated
23

Control statement

Uniquely identify and authenticate [Assignment: system services and applications] before establishing communications with devices, users, or other services or applications.

Discussion

Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.

ATT&CK mappings (CTID)

• T1036 Masquerading • T1036 Masquerading • T1036.001 Invalid Code Signature • T1036.005 Match Legitimate Name or Location • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1213.003 Code Repositories • T1525 Implant Internal Image • T1546 Event Triggered Execution • T1546.006 LC_LOAD_DYLIB Addition • T1546.013 PowerShell Profile • T1553 Subvert Trust Controls • T1553.004 Install Root Certificate • T1554 Compromise Host Software Binary • T1562.006 Indicator Blocking • T1562.009 Safe Mode Boot • T1566 Phishing • T1566.001 Spearphishing Attachment • T1566.002 Spearphishing Link • T1598 Phishing for Information • T1598.002 Spearphishing Attachment • T1598.003 Spearphishing Link

Related

Mitigates · not in database (2)

Mitigates · MITRE ATT&CK (20)

  • T1213.003 Code Repositories sub-technique
  • T1598 Phishing for Information technique
  • T1598.002 Spearphishing Attachment sub-technique
  • T1598.003 Spearphishing Link sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.002 AppleScript sub-technique
  • T1566 Phishing technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1553.004 Install Root Certificate sub-technique
  • T1554 Compromise Host Software Binary technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1553 Subvert Trust Controls technique
  • T1546.006 LC_LOAD_DYLIB Addition sub-technique
  • T1546.013 PowerShell Profile sub-technique
  • T1546 Event Triggered Execution technique
  • T1525 Implant Internal Image technique
  • T1036 Masquerading technique
  • T1059 Command and Scripting Interpreter technique

Related control · Compliance (5)

  • NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control

Referenced by Compliance · has member (1)

  • NIST-IA Identification and Authentication NIST 800-53 family

Referenced by Compliance · related control (6)

  • NIST-AC-4(17) Domain Authentication NIST 800-53 enhancement
  • NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control