Best Practice Detail
13-12-8770
Service Providers, Public Safety should use secure network protocols such as TLS or IPsec to provide integrity and confidentiality protection of SAML communications. In addition, the following measures should be implemented to counter replay, denial of service and other forms of attacks: (a) Clients should be required to authenticate at some level below the SAML protocol level (for example, using the SOAP over HTTP binding, with HTTP over TLS/SSL, and with a requirement for client-side certificates that have a trusted Certificate Authority at their root) to provide traceability and counter DOS attacks. (b) Use of the XML Signature element [ds:SignatureProperties] containing a timestamp should be required to determine if a signature is recent to counter replay attacks. (c) Maintaining state information concerning active sessions, and validate correspondence. (d) Correlation of request and response messages. This applies to Public Safety only in an NG9-1-1 environment.(a) Clients should be required to authenticate at some level below the SAML protocol level (for example, using the SOAP over HTTP binding, with HTTP over TLS/SSL, and with a requirement for client-side certificates that have a trusted Certificate Authority at their root) to provide traceability and counter DOS attacks. (b) Use of the XML Signature element [ds:SignatureProperties] containing a time stamp should be required to determine if a signature is recent to counter replay attacks. (c) Maintaining state information concerning active sessions, and validate correspondence. (d) Correlation of request and response messages.
Status: Rollover New
References/Comments: OASIS, Security and Privacy Considerations for the OASIS Security Assertion Markup Language (SAML) V2.0.
Historical events:
- Service Providers
- Public Safety
- Cable
- Internet/Data
- Satellite
- Wireless
- Wireline
- Cyber Security
- Information Protection
- Public Safety Service
- Encryption
- Intrusion Detection
- CSRIC VII: Rollover New In CSRIC VII