compliance controls are associated with this Policy definition 'Obscure feedback information during authentication process' (1ff03f2a-974b-3272-34f2-f6cd51420b30)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| FedRAMP_High_R4 |
IA-6 |
FedRAMP_High_R4_IA-6 |
FedRAMP High IA-6 |
Identification And Authentication |
Authenticator Feedback |
Shared |
n/a |
The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
Supplemental Guidance: The feedback from information systems does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For some types of information systems or system components, for example, desktops/notebooks with relatively large monitors, the threat (often referred to as shoulder surfing) may be significant. For other types of systems or components, for example, mobile devices with 2-4 inch screens, this threat may be less significant, and may need to be balanced against the increased likelihood of typographic input errors due to the small keyboards. Therefore, the means for obscuring the authenticator feedback is selected accordingly. Obscuring the feedback of authentication information includes, for example, displaying asterisks when users type passwords into input devices, or displaying feedback for a very limited time before fully obscuring it. Related control: PE-18.
Control Enhancements: None.
References: None. |
link |
1 |
| FedRAMP_Moderate_R4 |
IA-6 |
FedRAMP_Moderate_R4_IA-6 |
FedRAMP Moderate IA-6 |
Identification And Authentication |
Authenticator Feedback |
Shared |
n/a |
The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
Supplemental Guidance: The feedback from information systems does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For some types of information systems or system components, for example, desktops/notebooks with relatively large monitors, the threat (often referred to as shoulder surfing) may be significant. For other types of systems or components, for example, mobile devices with 2-4 inch screens, this threat may be less significant, and may need to be balanced against the increased likelihood of typographic input errors due to the small keyboards. Therefore, the means for obscuring the authenticator feedback is selected accordingly. Obscuring the feedback of authentication information includes, for example, displaying asterisks when users type passwords into input devices, or displaying feedback for a very limited time before fully obscuring it. Related control: PE-18.
Control Enhancements: None.
References: None. |
link |
1 |
| hipaa |
1002.01d1System.1-01.d |
hipaa-1002.01d1System.1-01.d |
1002.01d1System.1-01.d |
10 Password Management |
1002.01d1System.1-01.d 01.02 Authorized Access to Information Systems |
Shared |
n/a |
Passwords are not displayed when entered. |
|
2 |
| hipaa |
1006.01d2System.1-01.d |
hipaa-1006.01d2System.1-01.d |
1006.01d2System.1-01.d |
10 Password Management |
1006.01d2System.1-01.d 01.02 Authorized Access to Information Systems |
Shared |
n/a |
Passwords are not included in automated log-on processes. |
|
5 |
| ISO27001-2013 |
A.9.4.2 |
ISO27001-2013_A.9.4.2 |
ISO 27001:2013 A.9.4.2 |
Access Control |
Secure log-on procedures |
Shared |
n/a |
Where required by the access control policy, access to systems and applications shall be controlled by a secure log-on procedure. |
link |
17 |
| NIST_SP_800-171_R2_3 |
.5.11 |
NIST_SP_800-171_R2_3.5.11 |
NIST SP 800-171 R2 3.5.11 |
Identification and Authentication |
Obscure feedback of authentication information |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
The feedback from systems does not provide any information that would allow unauthorized individuals to compromise authentication mechanisms. For some types of systems or system components, for example, desktop or notebook computers with relatively large monitors, the threat (often referred to as shoulder surfing) may be significant. For other types of systems or components, for example, mobile devices with small displays, this threat may be less significant, and is balanced against the increased likelihood of typographic input errors due to the small keyboards. Therefore, the means for obscuring the authenticator feedback is selected accordingly. Obscuring authenticator feedback includes displaying asterisks when users type passwords into input devices or displaying feedback for a very limited time before fully obscuring it. |
link |
1 |
| NIST_SP_800-53_R4 |
IA-6 |
NIST_SP_800-53_R4_IA-6 |
NIST SP 800-53 Rev. 4 IA-6 |
Identification And Authentication |
Authenticator Feedback |
Shared |
n/a |
The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
Supplemental Guidance: The feedback from information systems does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For some types of information systems or system components, for example, desktops/notebooks with relatively large monitors, the threat (often referred to as shoulder surfing) may be significant. For other types of systems or components, for example, mobile devices with 2-4 inch screens, this threat may be less significant, and may need to be balanced against the increased likelihood of typographic input errors due to the small keyboards. Therefore, the means for obscuring the authenticator feedback is selected accordingly. Obscuring the feedback of authentication information includes, for example, displaying asterisks when users type passwords into input devices, or displaying feedback for a very limited time before fully obscuring it. Related control: PE-18.
Control Enhancements: None.
References: None. |
link |
1 |
| NIST_SP_800-53_R5 |
IA-6 |
NIST_SP_800-53_R5_IA-6 |
NIST SP 800-53 Rev. 5 IA-6 |
Identification and Authentication |
Authentication Feedback |
Shared |
n/a |
Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals. |
link |
1 |