BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

9.1 Access Control and Identity Authentication

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
added 9 Additional Considerations part of 9

Title changed

Before · SP 800-57 Part 1 Rev. 4

After · SP 800-57 Part 1 Rev. 5

Access Control and Identity Authentication

Control changed

Before · SP 800-57 Part 1 Rev. 4

After · SP 800-57 Part 1 Rev. 5

An access control system is needed to ensure that every key and metadata management function can only be initiated in response to a request by an authorized entity. When key-management functions are initiated by an entity, an access control system must ensure that the entity is authenticated, performing only the requested functions that are authorized, and that all applicable constraints are satisfied. The access-control system shall control access to and the initiation of all its key and metadata management services and functions, granting access and permission to initiate a requested service or function only after verifying the identity and authorization of the requesting entity to perform the requested service or function. In order to provide access control, a means of identifying the entities accessing the keys needs to be implemented. Commonly used methods include the use of two-factor authentication and digital signature certificates. These methods require identity proofing of the entities. SP 800-63 , SP 800- 130 , and SP 800-152 provide further discussions and requirements for access control and identity authentication. All access to keys should be recorded in audit logs for periodic and emergency examination, including both successful and failed attempts. See Section 9.4 for a discussion about auditing these logs.