[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-11":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-11","IA-11","Re-authentication",5,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Users must be required to re-authenticate in defined circumstances or situations.\n\n**In practice.** Typical triggers include changing authenticators or roles, performing privileged or sensitive actions, accessing high-value data and after a period of inactivity. In practice this is configured through identity provider session and conditional access policies and step-up authentication in applications. Auditors look for policy settings and examples of re-authentication in sensitive workflows. Phishing-resistant methods are preferable for step-up.\n\n**Common gaps.** Long sessions without re-authentication are common to reduce friction. Sensitive actions such as changing bank details or MFA settings often do not trigger step-up authentication. Re-authentication prompts that are too frequent also train users to approve without thinking, which can enable MFA fatigue attacks.","Require users to re-authenticate when [Assignment: organization-defined circumstances or situations].\nDiscussion: In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"browser-based-attacks-bypass-edr-by-exploiting-legitimate-sessions","Browser-Based Attacks Bypass EDR by Exploiting Legitimate Sessions","2026-10-02T16:21:18.74+00:00",{"slug":25,"title":26,"published_at":27},"session-hijacking-bypasses-mfa-as-top-identity-threat","Session Hijacking Bypasses MFA as Top Identity Threat","2026-09-10T16:22:56.996+00:00",{"slug":29,"title":30,"published_at":31},"ai-reasoning-apis-leaked-secrets-via-replayable-encrypted-objects","AI Reasoning APIs Leaked Secrets via Replayable Encrypted Objects","2026-08-12T14:21:27.218+00:00",{"slug":33,"title":34,"published_at":35},"mikrotik-routeros-session-flaw-exposes-wireguard-private-keys","MikroTik RouterOS Session Flaw Exposes WireGuard Private Keys","2026-07-30T19:21:17.215+00:00",{"slug":37,"title":38,"published_at":39},"acr-stealer-exploits-clickfix-social-engineering-to-harvest-browser-tokens-and-m365-data","ACR Stealer Exploits ClickFix Social Engineering to Harvest Browser Tokens and M365 Data","2026-07-17T12:21:45.38+00:00",[41,46,51,55,59,64],{"slug":42,"name":43,"problem":44,"stories":45},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":47,"name":48,"problem":49,"stories":50},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":52,"name":53,"problem":54,"stories":50},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":56,"name":57,"problem":58,"stories":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":60,"name":61,"problem":62,"stories":63},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":65,"name":66,"problem":67,"stories":63},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[69,74,79,84,89,94,98,102],{"family":5,"item":70,"code":71,"title":72,"together":73},"ac-12","AC-12","Session Termination",4,{"family":75,"item":76,"code":77,"title":78,"together":73},"gdpr","32","Article 32","Security of processing",{"family":80,"item":81,"code":82,"title":83,"together":45},"cis","16","Control 16","Application Software Security",{"family":85,"item":86,"code":87,"title":88,"together":45},"mitre-attack","t1539","T1539","Steal Web Session Cookie",{"family":90,"item":91,"code":92,"title":93,"together":50},"nist-sp","800-207","SP 800-207","SP 800-207: Zero Trust Architecture",{"family":80,"item":95,"code":96,"title":97,"together":50},"5","Control 5","Account Management",{"family":5,"item":99,"code":100,"title":101,"together":50},"si-4","SI-4","System Monitoring",{"family":90,"item":103,"code":104,"title":105,"together":50},"800-63","SP 800-63","SP 800-63: Digital Identity Guidelines"]