Kerberos
What is Kerberos?
A network authentication protocol that uses secret-key cryptography to authenticate client-server applications. Kerberos provides mutual authentication where both the user and server verify each other's identity.
Terms that appear alongside kerberos
Each of these is named in at least one of the same controls as kerberos. The number is how many controls name both.
- oauth 2 shared controls
- enisa 2 shared controls
- nist 2 shared controls
- authentication 2 shared controls
Frameworks that govern kerberos
What the standards actually require on kerberos
Requirements naming kerberos across 6 standards, quoted from the control text.
The plan must require risk-appropriate access non-repudiation protections and identity proofing, and the binding of assigned unique digital identities (non-shared accounts, tokens, session keys) to real-life identities;
api-1164::PR.AC-6 · PR.AC-6 Non-repudiation, identity proofing and binding of digital identities to real identities →Credentials for the Kerberos Key Distribution Center's service account (KRBTGT) are changed twice, allowing for replication to all Microsoft AD DS domain controllers in-between each change, if the domain has been directly compromised, the domain is suspected o...
ISM-1847 · Changing KRBTGT account credentials →The NDM SRG's general requirements, condensed from the Network Management Security Guidance At-a-Glance: management traffic carried on an out-of-band management network whose interface forwards no transit traffic, or where no OOBM port exists a management inte...
disa-security-technical-implementation-guides-stigs::SRG-6 · SRG-6 NDM general requirements: out-of-band or leak-free management network, SNMPv3, logging to syslog, AAA, authenticated NTP, secure image and configuration storage →NFS services should use versions and security modes that authenticate users and hosts and protect traffic (Kerberos-based security with integrity and privacy where available), restrict exports by host and identity, avoid legacy versions and permissive options,...
iso-iec-27040-2024::10.10.2 · NFS-based NAS →Authentication mechanisms that never send passwords across the network, such as Kerberos, shall be used.
iso-iec-29115-2013-entity-authentication-assurance-framework::10.3.C11 · Authentication control #11: NoTransmitPassword →Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication confirms that each party to a communication (for example a person, device, service or application) really is who it claims to be, and gives assurance that no party is impersonating anothe...
X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →Questions people ask about kerberos
What is Kerberos?
Why is Kerberos important for compliance?
Which compliance frameworks address Kerberos?
Where can I learn more about Kerberos?
See how Kerberos applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.