Navigate

CCI-000186

CCI-000186 Definition

For public key-based authentication, enforce authorized access to the corresponding private key.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

Determine if authorized access to the corresponding private key is enforced for public key-based authentication.

Validation Procedures

Examine: [SELECT FROM: Identification and authentication policy; procedures addressing authenticator management; system security plan; system design documentation; system configuration settings and associated documentation; PKI certification validation records; PKI certification revocation lists; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with PKI-based, authenticator management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers]. Test: [SELECT FROM: Mechanisms supporting and/or implementing PKI-based, authenticator management capability].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000186.

Control	Description
IA-5(2)	(a): For public key-based authentication: (1): Enforce authorized access to the corresponding private key; and (2): Map the authenticated identity to the account of the individual or group; and (b): When public key infrastructure (PKI) is used: (1): Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and (2): Implement a local cache of revocation data to support path discovery and validation.

Control

Description

IA-5(2)

(a): For public key-based authentication:
- (1): Enforce authorized access to the corresponding private key; and
- (2): Map the authenticated identity to the account of the individual or group; and

(b): When public key infrastructure (PKI) is used:
- (1): Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and
- (2): Implement a local cache of revocation data to support path discovery and validation.