Credentials Account for the Published Cryptographic Cryptographic following system Credential Policy and technology deployed technology deployed threats and apply Practices Statement through a Public Key through a Public Key appropriate controls: approved by internal Infrastructure Infrastructure – “soft” the introduction Policy Management certificates deployed on of malicious code; Authority hardware tokens compromised Strong passwords protected by authentication arising as per ISM password or from insider action; Non-PKI biometric controls out-of-band authentication attacks by other users protocols required and system operators (e.g., the ubiquitous shoulder-surfing); spoofing of system elements/applications malfeasance on the part of subscribers and subjects. Single factor authentication solutions acceptable
Credentials Account for the following system threats and apply appropriate controls: the introduction of malicious code; compromised authentication arising from insider action; out-of-band attacks by other users and system operators (e.g., the ubiquitous shoulder-surfing); spoofing of system elements/applications malfeasance on the part of subscribers and subjects. Single factor authentication solutions acceptable Published Credential Policy and Practices Statement approved by internal Policy Management Authority Strong passwords as per ISM Non-PKI authentication protocols required Cryptographic technology deployed through a Public Key Infrastructure – “soft” certificates Cryptographic technology deployed through a Public Key Infrastructure deployed on hardware tokens protected by password or biometric controls
draft-commercial-service-provider.docx