Summary of IAP element risks by AD Product

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="549321d3-4e09-40b1-a60f-171c9d7dd8a5"><ac:plain-text-body><![CDATA[

DS

LDS

FS

RMS

AAD [1]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="9f3ae8c1-4e98-4d2a-81d2-6af84e10aa18"><ac:plain-text-body><![CDATA[

4.2.3.4

Stored Authentication Secrets

No Salt in Hash [2]
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="71f76c31-b0f6-43d3-a9d3-a3526acf7312"><ac:plain-text-body><![CDATA[Not a FIPS approved method [2]
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a16c986d-c4a7-4373-9f24-bd8828fecaaf"><ac:plain-text-body><![CDATA[Can support low str methods (LM, NTLM)

No Salt in Hash [2]
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="14ddd48a-d025-45b3-86ad-9ed063b0272a"><ac:plain-text-body><![CDATA[Not a FIPS approved method [2]
]]></ac:plain-text-body></ac:structured-macro>
Can support low str methods (LM, NTLM)

n/a

n/a

OOS
(Out of 
scope)

4.2.3.5

Basic Protection of Authentication Secrets

Potential alternative credential issues
   (e.g., certs, cross-realm trust)
Cached credentials
Non-plaintext

Potential alternative credential issues
   (e.g., certs, cross-realm trust)
Cached credentials
Non-plaintext

n/a

n/a

OOS

4.2.3.6

Strong Protection of Authentication Secrets

Potential alternative credential issues
   (e.g., certs, cross-realm trust)
Cached credentials
   (claims "generally meets the standard")
Potential non-Protected Channels
Requires policy for 3rd party risk mitigation

Potential alternative credential issues
   (e.g., certs, cross-realm trust)
Cached credentials
   (claims "generally meets the standard")
Potential non-Protected Channels
Requires policy for 3rd party risk mitigation

n/a

n/a

OOS

4.2.4.5

Resist Token Issuance Tampering Threat?

(Need reference; probably meets this)

(Need reference; probably meets this)

(Need reference; probably meets this)

n/a

OOS

4.2.5.1

Resist Replay Attack

Can support low str methods (LDAP bind, LM)
Kerb replay concerns

Can support low str methods (LDAP bind, LM)
Kerb replay concerns

Can support low str methods (LDAP bind)

n/a

OOS

4.2.5.2

Resist Eavesdroper Attack

Can support low str methods (LDAP bind, LM)

Can support low str methods (LDAP bind, LM)

Can support low str methods (LDAP bind)

n/a

OOS

4.2.5.3

Secure Communication

Handled via Non-plaintext (B)
Requires Protected Channels + policy (S)

Handled via Non-plaintext (B)
Requires Protected Channels + policy (S)

Handled via Non-plaintext (B)
Requires Protected Channels + policy (S)

n/a

OOS

4.2.5.4

Resist Session Hijacking Threat?

?

?

(Need reference?)

n/a

OOS