A.8.5 Technological
Secure authentication
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (15)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-12mostlyaligns with — Both controls require automatic termination of sessions after a defined period of inactivity to reduce exposure on unattended or high-risk endpoints.
- AC-7mostlyaligns with — Both controls mandate technical measures to limit or block repeated unsuccessful log-on attempts and to trigger security events when thresholds are exceeded.
- IA-2mostlyaligns with — Both controls require authentication mechanisms whose strength is commensurate with the sensitivity of the resources being accessed and explicitly call for multi-factor authentication when stronger assurance is needed.
- IA-5mostlyaligns with — Both controls address the secure management and protection of authenticators, including rules for password handling, transmission, and the invalidation of compromised credentials such as biometrics.
- AC-8partialaligns with — Both controls require the presentation of a general warning banner or notice that only authorized users may access the system before authentication completes.
- AC-9partialaligns with — Both controls require the system to display or transmit the date/time of the last successful log-on and details of any intervening unsuccessful attempts upon successful authentication.
- IA-6partialaligns with — Both controls require that passwords or other authenticators are not displayed in clear text during entry to prevent shoulder-surfing or capture.
Aligned NIST CSF 2.0 outcomes (11)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-03fullcovers — The ISO control directly mandates authentication of users, services, and hardware using techniques whose strength matches the sensitivity of the information being accessed.
- PR.AA-01mostlyaligns with — The control addresses management of identities and credentials by specifying how authentication information must be protected, reset, and supplemented with additional factors.
- PR.AA-02mostlyaligns with — Requiring identity proofing and binding to credentials is implicit in the control’s emphasis on choosing appropriate authentication methods and invalidating compromised biometrics.
- PR.AA-05partialaligns with — Multi-factor rules triggered by context (location, device, time) and session termination after inactivity both enforce and review access authorizations.
- PR.IR-01partialaligns with — By preventing brute-force attacks, hiding sensitive information until authentication succeeds, and terminating inactive sessions, the control contributes to protecting networks and environments from unauthorized logical access.
- PR.PS-04partialaligns with — The control requires logging of successful and unsuccessful log-on attempts and raising security events when thresholds are exceeded, directly supporting log-record generation.
Related OWASP ASVS 5.0 requirements (15)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V6.2.6fullaligns with — The explicit instruction not to display passwords in clear text during entry matches the ASVS requirement that password fields use type=password to mask input.
- V7.3.1fullaligns with — The ISO directive to terminate inactive sessions after a defined period of inactivity implements the ASVS requirement for an inactivity timeout that forces re-authentication.
- V6.3.1mostlycovers — Guidance on blocking accounts or forcing resets after repeated failed attempts and on raising alerts for suspicious log-on patterns aligns with the ASVS requirement to implement documented controls against brute-force and credential-stuffing attacks.
- V6.3.3mostlycovers — The ISO control's requirement for multi-factor authentication when accessing critical systems directly implements the ASVS mandate that MFA or equivalent combined single-factor mechanisms must be used to reach high-value resources.
- V6.3.5partialaligns with — Sending alerts to users and administrators when a threshold of failed log-on attempts is reached partially satisfies the ASVS requirement to notify users of suspicious authentication attempts.
- V6.3.8partialaligns with — The rule that error messages must not reveal which part of the supplied credentials is correct or incorrect supports the ASVS goal of preventing attackers from deducing valid usernames from authentication feedback.
- V6.4.3partialaligns with — Requiring a secure password-reset process that does not bypass MFA when biometric or other factors are unavailable aligns with the ASVS requirement for a secure forgotten-password flow that preserves existing MFA protections.
Related weaknesses / CWE (168)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1191→PCWE-1254←PCWE-1270←P →PCWE-1390→FCWE-1391←F →MCWE-1393←P →PCWE-178←PCWE-187←PCWE-200→FCWE-204←P →PCWE-256←PCWE-257←F →PCWE-258←P →PCWE-260←PCWE-261←PCWE-262←PCWE-263←PCWE-283←PCWE-287→FCWE-288←M →PCWE-289←P →PCWE-290←F →MCWE-291←M →MCWE-293←P →FCWE-294←P →MCWE-296←PCWE-298←P →PCWE-299←P →PCWE-300←P →MCWE-301←P →MCWE-302←P →PCWE-303←F →PCWE-304←F →MCWE-305←P →PCWE-306→FCWE-307→PCWE-308←F →MCWE-309←F →MCWE-322←P →MCWE-324←PCWE-330←PCWE-331←PCWE-334→PCWE-340←P →PCWE-341←P →PCWE-345←P →PCWE-348←PCWE-350←P →PCWE-358←P →PCWE-370←P →PCWE-384←PCWE-408←P →PCWE-419←P →FCWE-420→MCWE-421←P →PCWE-424←P →PCWE-441←PCWE-488←PCWE-522→MCWE-523←PCWE-539←PCWE-549←PCWE-555←PCWE-565←P →PCWE-6←P →PCWE-603←F →MCWE-614←PCWE-620←P →PCWE-640←P →PCWE-642→PCWE-645←PCWE-654←F →MCWE-656→MCWE-697←PCWE-759←P →PCWE-760←P →PCWE-784←P →MCWE-804←P →PCWE-807←P →PCWE-836←F →PCWE-837←PCWE-916←PCWE-923←P →MCWE-940←P →M
Why these map — AI rationale (under review)
- CWE-1390fullprevents — Mandating multi-factor and non-password authentication techniques counters the use of inherently weak single-factor or password-only authentication mechanisms.
- CWE-200fullprevents — Suppressing system details, error specifics, and previous log-on information until successful authentication reduces the information an unauthenticated attacker can gather.
- CWE-287fullprevents — Requiring authentication methods whose strength matches the sensitivity of the data and mandating multi-factor authentication directly blocks attempts to access resources without proving identity.
- CWE-293fullprevents — Secure authentication explicitly requires strong, non-spoofable mechanisms, directly preventing reliance on the Referer header.
- CWE-306fullprevents — The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.
- CWE-419fullprevents — Secure authentication protects the primary channel from unauthorized use.
- CWE-1391mostlyprevents — Mandates secure authentication mechanisms that preclude use of weak or default credentials.
- CWE-290mostlyprevents — Secure authentication control directly mitigates authentication bypass by spoofing.
- CWE-291mostlyprevents — Secure-authentication control directly addresses the weakness by requiring proper credentials instead of IP address.
- CWE-294mostlyprevents — Secure authentication mechanisms directly prevent replay attacks by requiring fresh, non-replayable credentials or tokens.
- CWE-300mostlyprevents — Secure authentication mechanisms verify actor identity at both ends of the channel.
- CWE-301mostlyprevents — Secure authentication mechanisms directly address reflection attacks by requiring challenge-response designs that prevent replay of authentication tokens.
- CWE-304mostlyprevents — Mandates secure authentication mechanisms, explicitly addressing missing steps in authentication flows.
- CWE-308mostlyprevents — Secure authentication control explicitly requires multi-factor authentication, directly eliminating single-factor weakness.
- CWE-309mostlyprevents — Secure authentication control directly requires and guides non-password or hardened password mechanisms.
- CWE-322mostlyprevents — Secure authentication directly prevents unauthenticated key exchange by requiring verified identities before keys are established.
- CWE-420mostlyprevents — Secure authentication applies to primary channels but does not ensure alternate channels receive the same strength.
- CWE-522mostlyprevents — Forbidding clear-text transmission and display of passwords, plus the use of stronger alternatives to passwords, prevents credentials from being obtained or reused by attackers.
- CWE-603mostlyprevents — Requires server-side authentication mechanisms that directly prevent client-only checks.
- CWE-654mostlyprevents — Secure authentication explicitly requires multi-factor authentication, directly eliminating single-factor reliance.
- CWE-656mostlyprevents — Requires authentication mechanisms whose strength does not depend on secrecy of implementation.
- CWE-784mostlyprevents — Secure authentication mandates validation of session tokens, directly addressing reliance on unverified cookies.
- CWE-923mostlyprevents — Secure authentication mechanisms ensure the product communicates only with intended, authenticated endpoints.
- CWE-940mostlyprevents — Secure authentication mechanisms verify the identity and origin of communication channel initiators.
- CWE-1191partialmitigates — Secure authentication concepts apply to debug interfaces but the control focuses on user/system log-on.
- CWE-1270partialprevents — Secure authentication mechanisms directly govern the correct generation and validation of security tokens.
- CWE-1393partialmitigates — Requires secure authentication mechanisms, which includes replacing or disabling default credentials.
- CWE-204partialprevents — Strong authentication reduces information leakage from authentication responses.
- CWE-257partialprevents — Mandates secure authentication mechanisms that preclude recoverable password storage.
- CWE-258partialprevents — Mandates secure authentication mechanisms, preventing use of empty or weak passwords.
- CWE-288partialprevents — Secure authentication control directly mitigates bypass by requiring strong, consistent authentication on all paths.
- CWE-289partialprevents — Secure-authentication controls can require canonical identifiers and reject alternate names.
- CWE-298partialprevents — Secure authentication mandates validation of certificate attributes such as expiration dates.
- CWE-299partialprevents — Requires secure authentication mechanisms that rely on valid certificates.
- CWE-302partialprevents — Secure authentication explicitly requires server-side validation of all identity claims, directly eliminating this weakness.
- CWE-303partialprevents — Secure authentication control directly requires correct implementation of authentication algorithms.
- CWE-305partialprevents — Secure authentication mechanisms directly address bypass risks in the implemented authentication process.
- CWE-307partialprevents — CAPTCHA, account lock-out after repeated failures, and alerts on excessive attempts directly stop automated brute-force guessing of credentials.
- CWE-334partialmitigates — Secure authentication mechanisms often rely on unpredictable tokens or nonces, so weak randomness undermines them.
- CWE-340partialprevents — Secure authentication mechanisms depend on unpredictable session tokens, nonces and challenges; eliminating predictable identifiers strengthens authentication integrity.
- CWE-341partialprevents — Strong authentication mechanisms reduce reliance on predictable state-derived tokens or identifiers.
- CWE-345partialprevents — Secure authentication of data sources ensures only valid, authentic data is accepted.
- CWE-350partialprevents — Strong authentication mechanisms reduce reliance on unauthenticated DNS-based identity decisions.
- CWE-358partialprevents — Secure authentication control may be undermined if the underlying protocol checks are improperly implemented.
- CWE-370partialmitigates — Secure authentication mandates certificate validation, but does not explicitly require ongoing revocation checks after initial validation.
- CWE-408partialprevents — Secure authentication ensures identity verification occurs before expensive operations are allowed.
- CWE-421partialprevents — Strong authentication on all channels prevents unauthorized actors from using alternate paths.
- CWE-424partialmitigates — Secure authentication helps but does not guarantee every alternate path is protected.
- CWE-565partialprevents — Secure authentication mechanisms can enforce server-side validation and integrity checks that prevent reliance on untrusted cookies.
- CWE-6partialprevents — Secure authentication mandates sufficiently strong session identifiers, directly addressing insufficient session-ID length.
- CWE-620partialprevents — Mandates secure authentication mechanisms, which include verifying existing credentials before permitting password changes.
- CWE-640partialmitigates — Secure-authentication requirements include robust forgotten-password procedures.
- CWE-642partialprevents — Strong authentication helps ensure only legitimate users can reach the state data, but does not address storage location.
- CWE-759partialprevents — Secure authentication mandates salted, one-way hashes for credentials, directly preventing unsalted hashing.
- CWE-760partialprevents — Secure authentication mandates strong credential storage practices, directly addressing predictable salts in password hashing.
- CWE-804partialprevents — Strong authentication mechanisms include robust CAPTCHA implementations that resist automated guessing.
- CWE-807partialprevents — Strong authentication mechanisms reduce reliance on untrusted inputs for security decisions.
- CWE-836partialprevents — Mandates secure authentication mechanisms that preclude the flawed practice of treating password hashes as authenticators.
- CWE-1254nonenone — Secure authentication mechanisms can mandate constant-time comparisons, mitigating timing attacks from stepwise string comparison.
- CWE-1280nonenone — Strengthens authentication yet does not ensure the check occurs before asset access.
- CWE-1394nonenone — Requires secure authentication mechanisms that would be undermined by default keys.
- CWE-178nonenone — Authentication logic must treat identifiers consistently to avoid bypass via case differences.
- CWE-187noneprevents — Secure authentication mechanisms can reduce reliance on partial string comparisons for credential or token validation.
- CWE-256nonenone — Mandates secure authentication mechanisms that inherently require hashed or encrypted credentials rather than plaintext.
- CWE-260nonenone — Mandates secure authentication mechanisms and secret management, mitigating exposure of passwords in configuration files.
- CWE-261nonenone — Mandates secure authentication mechanisms, which precludes trivial encoding of passwords.
- CWE-262nonenone — Specifies secure authentication mechanisms that commonly include password aging and rotation requirements.
- CWE-263nonenone — Mandates secure authentication mechanisms that include appropriate password expiration settings.
- CWE-283nonenone — Secure authentication can be extended to verify resource ownership in addition to user identity.
- CWE-296nonenone — Requires secure authentication mechanisms that rely on valid certificate chains.
- CWE-324nonenone — Secure authentication requires cryptographic keys to be replaced before expiry, mitigating the weakness.
- CWE-330nonenone — Secure authentication mechanisms depend on unpredictable values (nonces, salts, session tokens) to resist guessing.
- CWE-331nonenone — Requires secure authentication mechanisms that depend on unpredictable secrets.
- CWE-335nonenone — Strong authentication mechanisms rely on unpredictable random values, indirectly requiring proper PRNG seeding.
- CWE-346noneprevents — Secure authentication verifies identity but does not address origin validation of arbitrary data flows.
- CWE-348nonemitigates — Strong authentication mechanisms ensure data originates from a trusted source, directly mitigating use of a less-trusted source.
- CWE-384nonenone — Secure-authentication control directly addresses session-token issuance and invalidation, covering most of the weakness.
- CWE-425nonenone — Secure authentication is a prerequisite but does not itself enforce per-resource authorization.
- CWE-441nonemitigates — Strong authentication of upstream callers helps the product verify and preserve the true source of each request.
- CWE-446nonenone — Secure authentication control may be undermined by UI discrepancies, but eliminating the weakness does not implement the authentication mechanism itself.
- CWE-471nonenone — Strong authentication limits the set of users who could tamper with assumed-immutable data.
- CWE-488nonenone — Secure authentication ensures each session is tied to the correct identity, preventing cross-session data exposure.
- CWE-523nonenone — Mandates secure authentication mechanisms, which typically require encrypted transport of credentials.
- CWE-539nonenone — Secure authentication mechanisms can avoid storing sensitive data in persistent cookies.
- CWE-549nonenone — Secure authentication explicitly requires masking of authentication secrets during entry.
- CWE-555nonenone — Mandates secure authentication mechanisms, which includes protecting credentials from exposure in configuration files.
- CWE-613nonenone — Automatic termination of inactive sessions and limits on connection duration shrink the window during which a hijacked or unattended authenticated session can be exploited.
- CWE-614nonenone — Secure authentication control requires protection of session credentials, directly addressed by setting the Secure flag on sensitive cookies.
- CWE-638nonenone — Secure authentication supports mediation but does not guarantee repeated checks after initial grant.
- CWE-639nonenone — Secure authentication verifies identity but does not enforce per-object authorization checks after login.
- CWE-645nonenone — Secure authentication mechanisms directly specify lockout thresholds, unlock processes, and monitoring to prevent abuse.
- CWE-697nonenone — Secure authentication mechanisms rely on correct comparison of credentials or tokens.
- CWE-757nonemitigates — Requires secure authentication mechanisms that typically rely on strong negotiated algorithms.
- CWE-837nonenone — Secure authentication can be used to enforce one-time actions, yet the control is not limited to this weakness.
- CWE-916nonemitigates — Mandates secure authentication mechanisms, directly addressing the need for computationally strong password hashes.
Mitigated MITRE ATT&CK techniques (8)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1078mostlyprevents — Mandating MFA and non-password authenticators raises the bar for attackers who have obtained valid credentials but still need an additional factor.
- T1110mostlyprevents — Locking accounts or requiring resets after repeated failed attempts, plus CAPTCHA, directly limits the number of guesses an attacker can make before being blocked.
- T1110.001mostlyprevents — The same brute-force protections and account lockouts reduce the feasibility of automated password guessing against individual accounts.
- T1110.003mostlyprevents — Rate-limiting and lockout mechanisms blunt password-spraying campaigns that rely on many rapid, low-and-slow attempts across numerous accounts.
- T1040partialmitigates — Prohibiting clear-text transmission of passwords over the network prevents credential capture by passive network sniffing.
- T1556.006partialmitigates — Requiring MFA and context-aware additional factors makes it harder for an adversary to abuse or bypass multi-factor authentication settings.
- T1557partialmitigates — Strong authentication methods and MFA reduce the success of adversary-in-the-middle attacks that attempt to intercept or replay credentials.
- T1621partialmitigates — Context-based additional authentication factors triggered by unusual location, device, or time help detect and block fraudulent MFA push requests.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.