CMMC SC.3.190 - Protect Authenticity of Communications Sessions

CMMC SC.3.190 - Protect Authenticity of Communications Sessions

Requirement text: SC.3.190: Protect the authenticity of communications sessions.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Authenticity protection includes protecting against man-in-the-middle attacks, session
hijacking, and the insertion of false information into communications sessions. This
requirement addresses communications protection at the session versus packet level (e.g.,
sessions in service-oriented architectures providing web-based services) and establishes
grounds for confidence at both ends of communications sessions in ongoing identities of
other parties and in the validity of information transmitted.

CMMC CLARIFICATION
The authentication of a session refers to a user entering login credentials to identify
themselves to establish communication to the system. As the communication is established
a unique session id is generated to identify the user session as authenticated. Organizations
need to develop and implement the necessary controls to validate the identification and
protect the session id from attacks such as hijacking.

Example
You are an IT administrator at your organization. You ensure that the two-factor user
authentication mechanism for the servers is setup and configured correctly. You maintain
the digital certificate your company purchased and replace it with a new one before the old
on expires. You ensure the TLS configuration settings on the web servers, VPN solution, and
other components that use TLS are correct, using secure settings that address risks against
attacks on the encrypted sessions.

References
• NIST SP 800-171 Rev 1 3.13.15
• NIST SP 800-53 Rev 4 SC-23

    • Related Articles

    • Systems and Communications Protection: SP 800-171 Security Family 3.13

      System and communications protection requirements provide an array of safeguards for the system. Some of the requirements in this family address the confidentiality information at rest and in transit. The protection of confidentiality can be provided ...

    • CMMC SC.2.179 - Encrypt Sessions for Network Devices Management

      Requirement text: SC.2.179: Use encrypted sessions for the management of network devices. DISCUSSION FROM SOURCE: CMMC Management of network devices is a security critical process and needs to have confidentiality protection and authentication to ...

    • CMMC SC.3.186 - Terminate Unnecessary Network Sessions

      Requirement text: SC.3.186: Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 This requirement applies to ...

    • CMMC SC.1.175 – Monitor and Control Communications

      Requirement text: SC.1.175: Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of information systems. ...

    • CMMC SC.3.191 - Protect CUI at Rest

      Requirement text: SC.3.191: Protect the confidentiality of CUI at rest. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-17 R2 Information at rest refers to the state of information when it is not in process or in transit and is located on storage devices ...