IA.L2-3.5.4: Replay-Resistant Authentication for Network Access
Replay attacks can compromise your network security by reusing captured authentication credentials to gain unauthorized access. CMMC Level 2 requires replay-resistant authentication mechanisms for all network accounts. This control ensures that captured authentication data cannot be reused to impersonate legitimate users.
What this means
Replay-resistant authentication prevents attackers from capturing and replaying authentication credentials to gain network access. Unlike basic authentication methods, replay-resistant mechanisms use time-based or challenge-response techniques that make captured credentials useless if intercepted. This control applies to both privileged accounts (admin, service accounts) and non-privileged user accounts accessing your network.
How to comply
- 1.Implement multi-factor authentication (MFA) using time-based one-time passwords (TOTP) or hardware tokens that change with each authentication attempt
- 2.Deploy challenge-response authentication mechanisms where the system generates unique challenges for each login session
- 3.Use Kerberos or similar protocols that employ session tickets and timestamps to prevent replay attacks
- 4.Enable cryptographic protocols like TLS/SSL for all remote access and VPN connections
- 5.Configure network access controls to require replay-resistant methods for both privileged and standard user accounts
- 6.Audit authentication logs to detect and block suspicious replay attempts or unusual access patterns
- 7.Test authentication mechanisms regularly to ensure they cannot be bypassed through captured credentials
Evidence auditors look for
- Multi-factor authentication configuration screenshots showing TOTP or hardware token requirements
- VPN and remote access policies requiring Kerberos or certificate-based authentication
- Authentication server logs documenting replay-resistant session creation and validation
- Network access control policies restricting login methods to approved replay-resistant mechanisms
- Security audit reports validating that authentication mechanisms prevent replay attacks
- Backup authentication system documentation showing timestamp and nonce implementation
- Employee training records confirming staff awareness of replay-resistant authentication requirements
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automatically monitors authentication configurations across your systems and alerts you when non-compliant access methods are detected, helping you maintain replay-resistant authentication enforcement for all accounts in real-time.
See how GRCWatch handles this control automatically
Start free trial