[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-3":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-3","IA-3","Device Identification and Authentication",26,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Defined devices or types of devices must be uniquely identified and authenticated before a local, remote or network connection is established.\n\n**In practice.** Doing this well means network access control with certificate-based authentication such as 802.1X, device certificates for VPN and zero trust access, and conditional access policies that check device identity and compliance. Auditors expect device authentication configurations, certificate management records and reports showing unauthenticated devices are blocked or quarantined. A device inventory makes it possible to spot devices that should not be there.\n\n**Common gaps.** Many networks still allow any device that is plugged in to connect. Printers, IoT and operational technology devices are commonly exempted without compensating controls. Device certificates are also sometimes issued without a process to revoke them when devices are lost or retired.","Uniquely identify and authenticate [Assignment: organization-defined devices and\u002For types of devices] before establishing a [Selection: local; remote; network] connection.\nDiscussion: Devices that require unique device-to-device identification and authentication are defined by type, device, or a combination of type and device. Organization-defined device types include devices that are not owned by the organization. Systems use shared known information (e.g., Media Access Control [MAC], Transmission Control Protocol\u002FInternet Protocol [TCP\u002FIP] addresses) for device identification or organizational authentication solutions (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1x and Extensible Authentication Protocol [EAP], RADIUS server with EAP-Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local and wide area networks. Organizations determine the required strength of authentication mechanisms based on the security categories of systems and mission or business requirements. Because of the challenges of implementing device authentication on a large scale, organizations can restrict the application of the control to a limited number\u002Ftype of devices based on mission or business needs.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"north-korean-it-workers-infiltrate-us-companies-via-laptop-farms-and-stolen-identities","North Korean IT Workers Infiltrate US Companies via Laptop Farms and Stolen Identities","2026-10-14T20:20:23.163+00:00",{"slug":25,"title":26,"published_at":27},"ai-agents-need-know-your-agent-controls-beyond-initial-authentication","AI Agents Need 'Know Your Agent' Controls Beyond Initial Authentication","2026-10-06T22:20:39.118+00:00",{"slug":29,"title":30,"published_at":31},"ai-powered-social-engineering-defeats-traditional-security-training","AI-Powered Social Engineering Defeats Traditional Security Training","2026-10-06T10:21:05.41+00:00",{"slug":33,"title":34,"published_at":35},"deepfakes-shatter-trust-in-visual-identity-verification","Deepfakes Shatter Trust in Visual Identity Verification","2026-10-05T12:20:21.472+00:00",{"slug":37,"title":38,"published_at":39},"critical-dell-csm-flaws-allow-unauthenticated-root-access-on-kubernetes-nodes","Critical Dell CSM Flaws Allow Unauthenticated Root Access on Kubernetes Nodes","2026-10-02T18:21:14.277+00:00",{"slug":41,"title":42,"published_at":43},"north-korean-it-worker-infiltration-inside-the-laptop-farm-deception","North Korean IT Worker Infiltration: Inside the Laptop Farm Deception","2026-09-22T10:21:14.191+00:00",{"slug":45,"title":46,"published_at":47},"cisco-ise-zero-day-exposes-api-authentication-bypass-risks","Cisco ISE Zero-Day Exposes API Authentication Bypass Risks","2026-09-18T20:20:25.682+00:00",{"slug":49,"title":50,"published_at":51},"byod-devices-used-as-launchpad-to-compromise-microsoft-365-via-graph-api","BYOD Devices Used as Launchpad to Compromise Microsoft 365 via Graph API","2026-09-10T22:20:40.873+00:00",{"slug":53,"title":54,"published_at":55},"ai-workflow-identity-hijacking-exposes-enterprise-data","AI Workflow Identity Hijacking Exposes Enterprise Data","2026-09-09T16:21:53.743+00:00",{"slug":57,"title":58,"published_at":59},"residential-proxies-and-vpns-are-defeating-edge-security-controls","Residential Proxies and VPNs Are Defeating Edge Security Controls","2026-09-01T16:21:32.91+00:00",{"slug":61,"title":62,"published_at":63},"danish-dpa-authorizes-biometric-facial-recognition-at-football-matches-under-strict-gdpr-conditions","Danish DPA Authorizes Biometric Facial Recognition at Football Matches Under Strict GDPR Conditions","2026-09-01T08:21:09.065+00:00",{"slug":65,"title":66,"published_at":67},"north-korean-operatives-infiltrate-legitimate-companies-via-fake-job-applications","North Korean Operatives Infiltrate Legitimate Companies via Fake Job Applications","2026-08-31T18:20:40.594+00:00",[69,74,79,83,87,92],{"slug":70,"name":71,"problem":72,"stories":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",13,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",6,{"slug":80,"name":81,"problem":82,"stories":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":84,"name":85,"problem":86,"stories":78},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":88,"name":89,"problem":90,"stories":91},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":93,"name":94,"problem":95,"stories":96},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,[98,104,110,115,120,125,129,133],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","32","Article 32","Security of processing",18,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","6","Control 6","Access Control Management",17,{"family":5,"item":111,"code":112,"title":113,"together":114},"ac-2","AC-2","Account Management",15,{"family":116,"item":117,"code":118,"title":118,"together":119},"itil","overview","ITIL",10,{"family":105,"item":121,"code":122,"title":123,"together":124},"12","Control 12","Network Infrastructure Management",8,{"family":105,"item":126,"code":127,"title":128,"together":124},"14","Control 14","Security Awareness and Skills Training",{"family":105,"item":130,"code":131,"title":132,"together":124},"7","Control 7","Continuous Vulnerability Management",{"family":105,"item":134,"code":135,"title":113,"together":78},"5","Control 5"]