Esc
Agent Authentication
Definition
Agent authentication is the process of verifying the identities of agents to ensure they are authorized and trustworthy participants within a system.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 6 techniques in this category, Agent Authentication.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Agent Authentication | D3-AA | Agent authentication is the process of verifying the identities of agents to ensure they are authorized and trustworthy participants within a system. | |
| - Token-based Authentication | D3-TBA | Token-based authentication is an authentication protocol where users verify their identity in exchange for a unique access token. Users can then access the website, application, or resource for the life of the token without having to re-enter their credentials. | |
| - Biometric Authentication | D3-BAN | Using biological measures in order to authenticate a user. | |
| - Password Authentication | D3-PWA | Password authentication is a security mechanism used to verify the identity of a user or entity attempting to access a system or resource by requiring the input of a secret string of characters, known as a password, that is associated with the user or entity. | |
| - Certificate-based Authentication | D3-CBAN | Requiring a digital certificate in order to authenticate a user. | |
| - Multi-factor Authentication | D3-MFA | Requiring proof of two or more pieces of evidence in order to authenticate a user. |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Privilege Escalation
Account Manipulation
Access Token Manipulation
Valid Accounts
Abuse Elevation Control Mechanism
Impact
Account Access Removal
Persistence
Account Manipulation
Create Account
Valid Accounts
Credential Access
Brute Force
OS Credential Dumping
Steal or Forge Kerberos Tickets
Steal Application Access Token
Steal Web Session Cookie
Keychain
Unsecured Credentials
Forge Web Credentials
Steal or Forge Authentication Certificates
Defense Evasion
Access Token Manipulation
Valid Accounts
Use Alternate Authentication Material
Abuse Elevation Control Mechanism
References
All
Guideline
The following references were used to develop the Agent Authentication knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
NIST Special Publication 800-53 Revision 5 - Security and Privacy Controls for Information Systems and Organizations
Reference Type: Guideline Organization: NIST