EPLC E-Authentication.xls
XLS spreadsheet 42 KB Posted
- Solicitation number
- FDA-SOL-11-1085941
About this file
EPLC E--Authentication
View the file
Other files
Show 40 more
Latest 50 of 56 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
e-Authentication Report
| eAuthentication Report |
| System Identification |
| 1. Select the Center and System Impact from the drop-down list displayed by clicking on the arrow that appears to the right of those green cells when active. |
2. Key in the System Acronym and System Name.
| Agency | FDA | System Acronym | |||
| Center | System Name | ||||
| System Impact | (from System Security Plan) | ||||
| Determine e-Authentication Requirement | |||||
| Select the appropriate answer from the drop-down list displayed by clicking on the arrow that appears to the right of any active cell. | |||||
| 1. | Is this an outward-facing system, that is, is it available on the Internet or Extranet? | ||||
| If yes, continue to Question 2. If no, you may stop here. | |||||
| 2. | Does the system require User Authentication? | ||||
| If yes, continue to Question 3. If no, you may stop here. | |||||
| 3. | Does this system contain Confidential, Proprietary, or Personal Identifying Information? | ||||
| If yes, complete the remainder of the form. If no, you may stop here. | |||||
| eAuthentication | |||||
| Select the appropriate Impact Level for each Impact Category from the drop-down list displayed by clicking on the arrow that appears to the right of any active cell in the last (green) column. | |||||
| Impact Categories and Levels | 0 | ||||
| AC | Impact Category | Low Impact | Moderate Impact | High Impact | Impact Level |
| AC1 | Inconvenience, distress or damage to standing or reputation | At worst, limited, short-term inconvenience, distress or embarrassment to any party. | At worst, serious short term or limited long-term inconvenience, distress or damage to the standing or reputation of any party. | Severe or serious long-term inconvenience, distress, or damage to the standing or reputation of any party (ordinarily reserved for situations with particularly severe effects or which affect many individuals). | |
| AC2 | Financial loss or agency liability | At worst, an insignificant or inconsequential unrecoverable financial loss to any party, or at worst, an insignificant or inconsequential agency liability. | At worst, a serious unrecoverable financial loss to any party, or a serious agency liability. | Severe or catastrophic unrecoverable financial loss to any party; or severe or catastrophic agency liability. | |
| AC3 | Harm to agency programs or public interests | At worst, a limited adverse effect on organizational operations or assets, or public interests. Examples of limited adverse effects are: |
(i) mission capability degradation to the extent and duration that the organization is able to perform its primary functions with noticeably reduced effectiveness, or
(ii) minor damage to organizational assets or public interests. At worst, a serious adverse effect on organizational operations or assets, or public interests. Examples of serious adverse effects are:
(i) significant mission capability degradation to the extent and duration that the organization is able to perform its primary functions with significantly reduced effectiveness; or
(ii) significant damage to organizational assets or public interests. A severe or catastrophic adverse effect on organizational operations or assets, or public interests. Examples of severe or catastrophic effects are:
(i) severe mission capability degradation or loss of to the extent and duration that the organization is unable to perform one or more of its primary functions; or
(ii) major damage to organizational assets or public interests.
| AC4 | Unauthorized release of sensitive information | At worst, a limited release of personal, United States (U.S.) government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a low impact as defined in FIPS PUB 199. | At worst, a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a moderate impact as defined in FIPS PUB 199. | A release of personal, U.S. government sensitive or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a high impact as defined in FIPS PUB 199. | ||||
| AC5 | Personal safety | At worst, minor injury not requiring medical treatment. | At worst, moderate risk of minor injury or limited risk of injury requiring medical treatment. | A risk of serious injury or death. | ||||
| AC6 | Civil or criminal violations | At worst, a risk of civil or criminal violations of a nature that would not ordinarily be subject to enforcement efforts. | At worst, a risk of civil or criminal violations that may be subject to enforcement efforts. | A risk of civil or criminal violations that are of special importance to enforcement programs. | ||||
| The values in the final column are calculations based on selections from the previous table. Do not change these values. | ||||||||
| Assurance Level Impact Profile Categories | ||||||||
| Potential Impact Categories for Authentication Errors | 1 | 2 | 3 | 4 | 0 | |||
| AC1 - Inconvenience, distress or damage to standing or reputation | Low | Mod | Mod | High | 0 | |||
| AC2 - Financial loss or agency liability | Low | Mod | Mod | High | 0 | |||
| AC3 - Harm to agency programs or public interests | N/A | Low | Mod | High | 0 | |||
| AC4 - Unauthorized release of sensitive information | N/A | Low | Mod | High | 0 | |||
| AC5 - Personal Safety | N/A | N/A | Low | Mod High | 0 | |||
| AC6 - Civil or criminal violations | N/A | Low | Mod | High | 0 | |||
| 0 | Overall Impact Level | |||||||
| 1. Find the column indicated by the Overall Impact Level. (The gray will be removed from this column based on the Assurance Level Impact Profile Categories table.) |
2. Place "X" in the row of each token type implemented in the system.
| Token Types | ||||
| Token Type | Level 1 | Level 2 | Level 3 | Level 4 |
| Password & PINs (e.g. Username & Password) | ||||
| Soft cryptographic token |
(A cryptographic key stored on a general-purpose computer. Password protocol is employed with the verifier.)
| One-time password device |
| Hard cryptographic token |
(The claimant shall be required to activate the key before using it with a password or biometric, or, alternatively, shall use a password as well as the key in an authentication protocol with the verifier.)
1. Find the column indicated by the Overall Impact Level. (The gray will be removed from this column based on the Assurance Level Impact Profile Categories table.)
2. Place "X" in the row of each protocol being used by the system.
| Authentication Protocol Types | ||||
| Protocol | Level 1 | Level 2 | Level 3 | Level 4 |
| Challenge-response password |
(When the shared secret is a password, an eavesdropper does not directly intercept the password itself.)
Tunneled to Zero knowledge password (A protocol where a password is sent through a protected channel. For example, the Transport Layer Security(TLS) protocol (i.e. Secure Sockets Layer (SSL)) is often used with a verifier’s public key certificate to (1) authenticate the verifier to the claimant, (2) establish an encrypted session between the verifier and claimant, and (3) transmit the claimant’s password to the verifier.)
Symmetric key Proof of Possession Protocol (PoP) (A cryptographic key that is used to perform both the cryptographic operation and its inverse, for example to encrypt and decrypt, or create a message authentication code and to verify the code.)
Private key PoP (The secret part of an asymmetric key pair that is typically used to digitally sign or decrypt data.)
| Results: The appropriate authentication mechanisms are in place if there is at least one "X" in a highlighted cell in each table above (in Token Types and in Protocol Types). | |
| Conclusion | |
| Select the appropriate button. | |
| Based on the information provided, the system has the appropriate authentication mechanisms in place in accordance with NIST SP 800-63. | |
| Based on the information provided, the system has not implemented appropriate authentication mechanisms in accordance with NIST SP 800-63. | |
| If the system has not implemented appropriate authentication mechanisms (option 2) describe how the OP DIV Plans to identify/implement additional compensating security controls to mitigate potential impacts to the system. |
Lists
| CBER | No | 1 | Low | N/A |
| CDER | Yes | 2 | Moderate | Low |
| CDRH | 3 | High | Mod | |
| CFSAN | 4 | High | ||
| CVM | ||||
| NCTR | ||||
| OC | ||||
| ORA |
File details come from the government source that posted it. Updated .