In this edition of the On Call Compliance Solutions Compliance Tip of the Week, we focus on obscuring authenticator feedback from systems so as to not provide any information that would allow unauthorized individuals to compromise authentication mechanisms.

YouTube – NIST 800-171 Control 3-5-11 – Obscure feedback of authentication information.

It provides a description of how to check practice and provides a fix. This link provides an example of a network device that must obscure feedback of authentication information.

Vaulted – Network Device Management Security Requirements Guide.This example policy describes how information resources shall obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals. Texas A&M Policy: Authenticator Feedback (IA-6).This link discusses the process of testing web applications for default credentials. Open Web Application Security Project (OWASP) – Testing for Default Credentials.The STIG finding describes a finding where the Oracle Database system failed to obscure feedback of authentication information. DISA – Security Technical Information Guide (STIG): Oracle database Finding and Fix.

The STIG lists a rather obvious check and a fix. The STIG finding describes a finding where the operating system failed to obscure feedback of authentication information. DISA – Security Technical Information Guide (STIG): MAC OS Finding and Fix.This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2.

System checkup 3.5