IA-02(08) Access to Accounts — Replay Resistant
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Access to Accounts — Replay Resistant
Control
Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts].
Discussion
Authentication processes resist replay attacks if it is impractical to achieve successful authentications by replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges such as time synchronous or cryptographic authenticators.
Parameters
ia-02.08_odp: [privileged accounts; non-privileged accounts]
Assessment objective
IA-02(08) replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts] are implemented.
STIG rules that implement this control 27
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-15-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-15-003030 CAT II The macOS system must allow smart card authentication.
- APPL-15-003050 CAT II The macOS system must enforce multifactor authentication for login.
- APPL-15-003051 CAT II The macOS system must enforce multifactor authentication for the su command.
- APPL-15-003052 CAT II The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-26-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-26-003030 CAT II The macOS system must allow smart card authentication.
- APPL-26-003050 CAT II The macOS system must enforce multifactor authentication for login.
- APPL-26-003051 CAT II The macOS system must enforce multifactor authentication for the su command.
- APPL-26-003052 CAT II The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Application Security and Development V6R5
- APSC-DV-001620 CAT II The application must implement replay-resistant authentication mechanisms for network access to privileged accounts.
- APSC-DV-001630 CAT II The application must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.
Cisco IOS XE Router NDM Y26M04
- CISC-ND-001200 CAT I The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.
Microsoft Edge V2R5
- EDGE-00-000062 CAT II The built-in DNS client must be disabled.
Microsoft Windows Server 2022 V2R11
- WN22-DC-000020 CAT II Windows Server 2022 Kerberos user logon restrictions must be enforced.
- WN22-DC-000030 CAT II Windows Server 2022 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
- WN22-DC-000040 CAT II Windows Server 2022 Kerberos user ticket lifetime must be limited to 10 hours or less.
- WN22-DC-000050 CAT II Windows Server 2022 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
- WN22-DC-000060 CAT II Windows Server 2022 computer clock synchronization tolerance must be limited to five minutes or less.
Microsoft Windows Server 2025 V1R4
- WN25-DC-000020 CAT II Windows Server 2025 Kerberos user logon restrictions must be enforced.
- WN25-DC-000030 CAT II Windows Server 2025 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.
- WN25-DC-000040 CAT II Windows Server 2025 Kerberos user ticket lifetime must be limited to 10 hours or less.
- WN25-DC-000050 CAT II Windows Server 2025 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.
- WN25-DC-000060 CAT II Windows Server 2025 computer clock synchronization tolerance must be limited to five minutes or less.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-611160 CAT II RHEL 9 must use the common access card (CAC) smart card driver.