3.5.2 Authenticate Identities of Users, Processes or Devices

3.5.2 Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational systems.

To go back to the NIST 800-171 Controls page click here.

Guides

• SANS Institute – An Overview of Different Authentication Methods and Protocols
• (DRAFT) NIST SP 800­63B Digital Identity Guidelines – Authentication and Lifecycle Management
• OWASP – Authentication Cheat Sheet
• SANS Institute – Implementing IEEE 802.1x for Wired Networks

Example Tools

• Knowledge-based Authentication
• Biometric-based Authentication
• Possession-based Authentication

Sample Policy & Procedures

• Environmental Protection Agency – Information Security – Identification and Authentication Procedure

Additional Lessons Learned

• University of Tennessee at Chattanooga – Guide to Computer Network Security – Chapter 10
• Cornell University – Something You Know, Have, or Are

Videos

• YouTube – Identification and Authentication – Information Security Lesson #2 of 12

Vendor Documentation

• Thales Group – Strong Authentication Best Practices