IA-03(01) Cryptographic Bidirectional Authentication
All changes in this version
Title
Cryptographic Bidirectional Authentication
Control
Authenticate [Assignment: devices and/or types of devices] before establishing [Selection (one or more): local; remote; network] connection using bidirectional authentication that is cryptographically based.
Discussion
A local connection is a connection with a device that communicates without the use of a network. A network connection is a connection with a device that communicates through a network. A remote connection is a connection with a device that communicates through an external network. Bidirectional authentication provides stronger protection to validate the identity of other devices for connections that are of greater risk.
Parameters
ia-03.01_odp.01: devices and/or types of devices
ia-03.01_odp.02: [local; remote; network]
Related controls
sc-12, sc-13, sc-8
Assessment objective
IA-03(01) [Assignment: devices and/or types of devices] are authenticated before establishing [Selection (one or more): local; remote; network] connection using bidirectional authentication that is cryptographically based.
STIG rules that implement this control 8
Application Security and Development V6R5
- APSC-DV-001660 CAT II Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS.
Cisco IOS XE Router NDM Y26M04
- CISC-ND-001130 CAT II The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
- CISC-ND-001150 CAT II The Cisco router must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
Microsoft Windows 11 V2R11
- WN11-CC-000165 CAT II Unauthenticated RPC clients must be restricted from connecting to the RPC server.
Microsoft Windows Server 2022 V2R11
- WN22-MS-000040 CAT II Windows Server 2022 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems.
- WN22-SO-000090 CAT II Windows Server 2022 computer account password must not be prevented from being reset.
Microsoft Windows Server 2025 V1R4
- WN25-MS-000040 CAT II Windows Server 2025 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and stand-alone or nondomain-joined systems.
- WN25-SO-000090 CAT II Windows Server 2025 computer account password must not be prevented from being reset.