IA-5(17)

Requirement

Employ presentation attack detection mechanisms for biometric-based authentication.

Discussion

Biometric characteristics do not constitute secrets. Such characteristics can be obtained by online web accesses, taking a picture of someone with a camera phone to obtain facial images with or without their knowledge, lifting from objects that someone has touched (e.g., a latent fingerprint), or capturing a high-resolution image (e.g., an iris pattern). Presentation attack detection technologies including liveness detection, can mitigate the risk of these types of attacks by making it difficult to produce artifacts intended to defeat the biometric sensor.

Title

Authenticator Management | Presentation Attack Detection for Biometric Authenticators
Family

Identification and Authentication
NIST 800-53B Baseline(s)

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; procedures addressing identifier management; system security plan; system design documentation; mechanisms providing dynamic binding of identifiers and authenticators; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with identification and authentication management responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Mechanisms supporting and/or implementing account management capability; mechanisms supporting and/or implementing identification and authentication management capabilities for the system].

ID	Assessment Objectives
IA-05(17)	presentation attack detection mechanisms are employed for biometric-based authentication.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!