Does your organization implement controls to protect identity assertions used in federated authentication systems?
Explanation
Identity assertions contain sensitive authentication and user information that is exchanged between federated systems (such as SAML tokens, OAuth tokens, or JWT). These assertions need protection against interception, tampering, and replay attacks through measures like encryption, digital signatures, and secure transmission protocols. Proper protection prevents unauthorized access to systems and data through compromised identity information.
Evidence could include documentation of implemented security controls for federated identity systems, such as configuration files showing encryption settings, certificate management procedures, token validation rules, and network traffic protection measures for identity providers and service providers.
Implementation Example
Protect identity assertions that are used to convey authentication and user information between federated systems
ID: PR.AA-04.205
Context
- Function
- PR: PROTECT
- Category
- PR.AA: Identity Management, Authentication, and Access Control
- Sub-Category
- Identity assertions are protected, conveyed, and verified
Related questions
- Does your organization have a formal process to request, track, review, and fulfill access requests that includes appropriate approval from system or data owners?
- Does your organization have a formal process for managing the lifecycle of cryptographic certificates, keys, identity tokens, and other credentials?
- Does your organization use unique device identifiers based on immutable hardware characteristics or secure provisioning methods?
- Does your organization physically label all authorized hardware assets with unique identifiers for inventory tracking and servicing purposes?
- Does your organization verify individuals' identities during enrollment using government-issued credentials?
- Does your organization issue unique credentials to each individual user and prohibit credential sharing?