232 – Require equipment identity

Summary

A system with critical information must require the identification of the equipment from which a user or system is authenticated.

Description

The requirement includes capturing information about the device used for access that can be used to identify it uniquely. This can include information such as device ID, hardware characteristics, IP address, or other identifying data. It helps to ensure that the authentication request is being originated from a recognized and authorized device, reducing the risk of unauthorized access to critical data.

Supported In

Advanced: True

References

• CAPEC-114. Authentication abuse
• OWASP10-A7. Identification and authentication failures
• MITRE-M1025. Privileged process integrity
• SANS25-13. Improper authentication
• PDPO-S1_4. Security of personal data
• CMMC-MP_L2-3_8_1. Media protection
• CMMC-MP_L2-3_8_8. Shared media
• HITRUST-01_k. Equipment identification in networks
• HITRUST-08_b. Physical entry controls
• ISO27002-5_37. Documented operating procedures
• OSSTMM3-8_7_4. Physical security (controls verification) - Integrity
• PTES-7_4_4_1. Post Exploitation - Pillaging (user information on system)
• SWIFTCSC-3_1. Physical security
• SIG-D_1_1_2. Asset and information management
• ASVS-2_8_2. One time verifier
• ISO27001-5_37. Documented operating procedures
• CASA-2_8_2. One Time Verifier
• CWE25-287. Improper authentication

Last updated

2024/02/05