BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.2 Federation Threat Mitigation Strategies

NIST PIV and digital identity SP 800-63C
All changes in this version
first version loaded 8 Security part of 8

Title

Federation Threat Mitigation Strategies

Control

Mechanisms that assist in mitigating the above threats are identified in Table 8-2.

Table 8-2 Mitigating Federation Threats

Federation Threat/Attack Description Example

Assertion Manufacture or Modification Cryptographically sign the assertion at IdP and verify at RP 4.1 , 6

Send assertion over an authenticated protected channel authenticating the IdP 7.1 , 7.2

Include a non-guessable random identifier in the assertion 6.2.1

Assertion Disclosure Send assertion over an authenticated protected channel authenticating the RP 7.1 , 7.2

Encrypt assertion for a specific RP (may be accomplished by use of a 6.2.3 Federation Threat/Attack Description Example

mutually authenticated protected channel)

Assertion Repudiation by the IdP Cryptographically sign the assertion at the IdP with a key that supports non- repudiation; verify signature at RP 6.2.2

Assertion Repudiation by the Subscriber Issue holder-of-key assertions; proof of possession of presented key verifies subscriber’s participation 6.1.2

Assertion Redirect Include identity of the RP (“audience”) for which the assertion is issued in its signed content; RP verifies that they are intended recipient 6 , 7.1 , 7.2

Assertion Reuse Include an issuance timestamp with short validity period in the signed content of the assertion; RP verifies validity 6 , 7.1 , 7.2