NIST Guidances and Identity Access Controls

As you probably know, the National Institute of Standards and Technology (NIST) is a key player in establishing cybersecurity standards and guidelines that help organizations protect their information systems and data. Among these guidelines, identity controls are crucial for ensuring secure access to sensitive information and systems. 

This blog will explore Identity Access controls and these Key NIST guidances:

• NIST Cybersecurity Framework (CSF) 1.1 and 2.0
• NIST Special Publication (SP) 800-53
• NIST Special Publication (SP) 800-63
• NIST SP 800-171 (Basis for CMMC)
• NIST SP 800-207 (Guidance on Zero Trust)

Image #1: YouAttest helps meets the identity access controls highlighted in the NIST guidances.

NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) is a voluntary framework that provides organizations with a risk-based approach to managing cybersecurity.

NIST CSF 1.1 

Within the Protect function, the Identity Management, Authentication, and Access Control (PR.AC) category outlines specific subcategories related to identity and access management controls:

• PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.
• PR.AC-2: Physical access to assets is managed and protected.
• PR.AC-3: Remote access is managed.
• PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
• PR.AC-5: Network integrity is protected (e.g., network segregation, network segmentation).

These subcategories emphasize the importance of managing identities and access controls to protect critical assets from unauthorized access.

NIST CSF 2.0

NIST CSF 2.0 was officially released last February 26, 2024 – an important milestone for the cyber security industry.   

NIST CSF 2.0 calls out for governance of identities in the following section. (It is important to note that NIST CSF 2.0 has added a whole section on governance.)

GG.RR:   Roles and Responsibilities 

Cybersecurity roles and responsibilities are coordinated and aligned with all internal and external stakeholders to enable accountability, performance assessment, and continuous improvement (formerly ID.GV-2)

• GG.RR-02:  Roles and responsibilities related to cybersecurity risk management are established and communicated (formerly ID.GV-2, ID.AM-6, and DE.DP-1)

PR.AA:   Identity Management, Authentication, and Access Control  

Access to physical and logical assets is limited to authorized users, processes, and devices, and is managed commensurate with the assessed risk of unauthorized access (formerly PR.AC)

• PR.AA-01:  Identities and credentials for authorized users, processes, and devices are managed by the organization (formerly PR.AC-1)
• PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions (formerly PR.AC-6)
• PR.AA-05:  Access permissions, entitlements, and authorizations are managed and enforced, incorporating the principles of least privilege and separation of duties (formerly PR.AC-3 and PR.AC-4)
• PR.AA-06:  Account activities and access events are audited and monitored to enforce authorized access (formerly PR.AC-1 and PR.AC-3)

NIST Special Publication (SP) 800-53

NIST SP 800-53, titled “Security and Privacy Controls for Information Systems and Organizations,” provides a catalog of security and privacy controls for federal information systems and organizations. It is widely used beyond the federal sector, serving as a benchmark for many organizations’ cybersecurity practices. The publication is divided into various control families, with the Access Control (AC) family specifically addressing identity controls.

Key controls in the Access Control family include:

• AC-1: Access Control Policy and Procedures – Establishing policies and procedures for managing access to information systems.
• AC-2: Account Management – Managing user accounts, including their creation, modification, and termination.
• AC-3: Access Enforcement – Implementing mechanisms to enforce access restrictions based on user roles and permissions.
• AC-4: Information Flow Enforcement – Controlling the flow of information within the system to ensure it aligns with security policies.
• AC-5: Separation of Duties – Ensuring that critical tasks are divided among different individuals to prevent fraud and errors.
• AC-6: Least Privilege – Granting users the minimum access necessary to perform their duties.
• AC-7: Unsuccessful Login Attempts – Monitoring and responding to failed login attempts to detect potential security breaches.
• AC-8: System Use Notification – Informing users about the acceptable use of information systems and the monitoring of their activities.
• AC-17: Remote Access – Managing and securing remote access to the information system.
• AC-18: Wireless Access – Controlling and securing wireless access to the information system.
• AC-19: Access Control for Mobile Devices – Managing and securing access from mobile devices.
• AC-20: Use of External Information Systems – Establishing controls for accessing the information system from external systems.

NIST Special Publication (SP) 800-63

NIST SP 800-63, titled “Digital Identity Guidelines,” provides detailed guidance on managing digital identities, including authentication and lifecycle management. This publication is divided into several volumes, each addressing different aspects of digital identity management:

• SP 800-63A: Enrollment and Identity Proofing – Guidance on verifying identities during the enrollment process.
• SP 800-63B: Authentication and Lifecycle Management – Guidelines on selecting, implementing, and managing authentication mechanisms.
• SP 800-63C: Federation and Assertions – Guidance on using federated identity systems and managing assertions.

NIST SP 800-171 (Basis for CMMC)

The NIST SP 800-171 lays out the requirements for any non-federal agency that handles controlled unclassified information (CUI), or other sensitive federal information.

The publication is particularly relevant for contractors and organizations working with the federal government, as they must comply with these standards to handle CUI securely.

Key Requirements Related to Identity Controls

NIST 800-171 is divided into 14 families of security requirements. Several of these families directly relate to identity controls:

• Access Control (AC)
• • AC.1.001: Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
  • AC.1.002: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
  • AC.1.003: Verify and control/limit connections to and use of external information systems.
• Identification and Authentication (IA)
• • IA.1.076: Identify information system users, processes acting on behalf of users, and devices.
  • IA.2.078: Authenticate (or verify) the identities of users, processes, and devices as a prerequisite to allowing access to organizational information systems.
• Audit and Accountability (AU)

1. • AU.2.041: Ensure that the actions of individual users can be uniquely traced to those users so they can be held accountable for their actions.

Implementing Identity Controls in NIST 800-171

To comply with NIST 800-171, organizations need to implement robust identity controls that cover both the access control and identification and authentication requirements. Here are the key steps that relate to identity access:

1. Establish an IAM Policy: Develop and enforce policies that govern how users are granted access to systems and data. This includes defining roles and responsibilities, access levels, and procedures for granting and revoking access.
2. Regularly Review Access Rights: Periodically review and update access rights to ensure that only authorized users have access to necessary information. This includes removing access for users who no longer need it.

NIST Special Publication 800-207 (Guidance on Zero Trust)

NIST SP 800-207, titled “Zero Trust Architecture,” provides a framework for implementing a zero trust security model. Zero trust is a cybersecurity paradigm that assumes that threats can exist both inside and outside the network. Therefore, it requires strict verification for every user and device attempting to access resources on the network.

Zero trust emphasizes continuous verification of users and devices, robust authentication mechanisms, and the principle of least privilege. Key concepts in NIST 800-207 related to identity controls include:

• Continuous Verification
• • Every access request, whether from within or outside the network, is continuously verified. This means that user identities must be authenticated and authorized for each request.
• Least Privilege Access
• • Users are granted the minimum level of access necessary to perform their jobs. This reduces the risk of unauthorized access to sensitive information.
• Micro-Segmentation

1. • Network resources are segmented into smaller zones, each requiring separate authentication and authorization. This limits the potential impact of a security breach.

Implementing Identity Controls in NIST 800-207

To implement a zero trust architecture as outlined in NIST 800-207, organizations need to enhance their identity controls significantly. Here are some steps to consider related to identity access:

1. Enforce Least Privilege Access: Regularly review and update user access rights to ensure they are aligned with the principle of least privilege. Use role-based access control (RBAC) to manage access based on job functions.
2. Implement Micro-Segmentation: Divide the network into smaller segments, each with its own access controls. Ensure that users and devices must authenticate separately for each segment they access.
3. Use Real-Time Monitoring and Analytics: Employ advanced monitoring tools to continuously analyze user behavior and network traffic. Detect and respond to anomalies that could indicate potential security threats.

Implementing Identity Controls Using NIST Guidelines

Identity controls are a critical component of cybersecurity, ensuring that only authorized users can access sensitive information and systems. NIST provides comprehensive guidelines and frameworks to help organizations implement effective identity and access management practices. By following these guidelines and integrating identity controls into their cybersecurity strategy through cloud-based, automated YouAttest, organizations can enhance their security posture, protect their assets, and comply with regulatory requirements.

YouAttest Executes on NIST Identity Access Controls 

The CSF categories and subcategories call out that enterprises not only have a policy and practice to provide entitlements – but have a process and practice to REVIEW the granted entitlements. This is where YouAttest comes in.

YouAttest has created and executed on a cloud-service that automates the process of User Access Reviews  (YouAttest has transacted over 3.1M attestation at time of this posting.)

The functionality required is:

• A user access review (UAR) is a process that involves regularly reviewing access rights and entitlements  for a company’s users. The goal is to limit the number of users, be they employees, contractors or/and partners who can access sensitive data (PII, PHI, CHI)  to reduce data theft and other data misuse.

YouAttest has created and entire platform around the concept of UARs and enforcing the principle of least privilege by allowing business and resource owners to Identify and eliminate:

• Over-privileged accounts
• Ghost accounts
• Identify orphan accounts

—

YouAttest is the only cloud-based IGA platform that deploys in minutes via application SSO into your existing IAM platforms.  Contact us to learn how YouAttest can automate your access review process and help your enterprise the necessary NIST identity access controls on your environment.