THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · IA-11

Re-authentication

US National Institute of Standards and Technology (NIST) · cited in 5 of our lessons

Explanation

What it asks for. Users must be required to re-authenticate in defined circumstances or situations.

In practice. Typical triggers include changing authenticators or roles, performing privileged or sensitive actions, accessing high-value data and after a period of inactivity. In practice this is configured through identity provider session and conditional access policies and step-up authentication in applications. Auditors look for policy settings and examples of re-authentication in sensitive workflows. Phishing-resistant methods are preferable for step-up.

Common gaps. Long sessions without re-authentication are common to reduce friction. Sensitive actions such as changing bank details or MFA settings often do not trigger step-up authentication. Re-authentication prompts that are too frequent also train users to approve without thinking, which can enable MFA fatigue attacks.

Open SP 800-53 at NIST
The official text
Require users to re-authenticate when [Assignment: organization-defined circumstances or situations]. Discussion: In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.