[cabfpub] Ballot 221 v3: Two-Factor Authentication and Password Improvements
Tim Hollebeek
tim.hollebeek at digicert.com
Thu May 17 09:18:53 MST 2018
Awesome.
Thank you, Eric.
-Tim
From: Public [mailto:public-bounces at cabforum.org] On Behalf Of Eric Mill via Public
Sent: Thursday, May 17, 2018 10:43 AM
To: Geoff Keating <geoffk at apple.com>; CA/Browser Forum Public Discussion List <public at cabforum.org>
Subject: Re: [cabfpub] Ballot 221 v3: Two-Factor Authentication and Password Improvements
FedRAMP has published guidance about the new NIST password/identity guidelines:
https://www.fedramp.gov/assets/resources/documents/CSP_Digital_Identity_Requirements.pdf
They note that the formal baseline is still not updated, but encourage folks to follow NIST's new guidance regardless:
NOTE: At the time of this document’s publication, FedRAMP Moderate and High controls IA-5 (g)
and IA-5 (1) (a,d) are known to be more restrictive than the new password requirements in 800-
63B, AAL2 and AAL3 respectively. FedRAMP recommends Agency AOs accept compliance with
NIST’s guidance that is most up-to-date and consistent with current cyber security threats. This
may be done using an implementation status of “Alternative Implementation.”
I also confirmed with the FedRAMP program that the baseline is expected to be updated to match NIST's SP 800-63, and thus avoid the need for any special acceptance. But the point is that FedRAMP is not an obstacle to dropping password rotation -- they are expecting service providers to follow NIST's guidance and drop it.
-- Eric
On Tue, May 15, 2018 at 6:48 PM, Geoff Keating via Public <public at cabforum.org <mailto:public at cabforum.org> > wrote:
> On May 15, 2018, at 8:37 AM, Patrick Tronnier via Public <public at cabforum.org <mailto:public at cabforum.org> > wrote:
>
> I want to make it clear that OATI agrees with the minimum 2 year password period as the more secure route. It is FedRAMP and other standards which don’t. J
I've been looking at FedRAMP, because I was surprised they'd be putting out guidelines that conflict with NIST guidelines, and I can't find this requirement; for the 'high security controls' (https://www.fedramp.gov/assets/resources/documents/FedRAMP_High_Security_Controls.xlsx), it does require you have a minimum and maximum password lifetime in IA-05(1)(d), but it says the actual limits are organization-defined, so you can ask the organization to set the maximum lifetime to, say, 3 years.
_______________________________________________
Public mailing list
Public at cabforum.org <mailto:Public at cabforum.org>
https://cabforum.org/mailman/listinfo/public
--
Eric Mill
Senior Advisor, Technology Transformation Services
Federal Acquisition Service, GSA
eric.mill at gsa.gov <mailto:eric.mill at gsa.gov> , +1-617-314-0966
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/public/attachments/20180517/7527ce0e/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4940 bytes
Desc: not available
URL: <http://cabforum.org/pipermail/public/attachments/20180517/7527ce0e/attachment-0001.p7s>
More information about the Public
mailing list