[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-11":3},{"item":4,"lessons":18,"controls":49,"related":77},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-11","IA-11","Re-authentication",5,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Users must be required to re-authenticate in defined circumstances or situations.\n\n**In practice.** Typical triggers include changing authenticators or roles, performing privileged or sensitive actions, accessing high-value data and after a period of inactivity. In practice this is configured through identity provider session and conditional access policies and step-up authentication in applications. Auditors look for policy settings and examples of re-authentication in sensitive workflows. Phishing-resistant methods are preferable for step-up.\n\n**Common gaps.** Long sessions without re-authentication are common to reduce friction. Sensitive actions such as changing bank details or MFA settings often do not trigger step-up authentication. Re-authentication prompts that are too frequent also train users to approve without thinking, which can enable MFA fatigue attacks.","Require users to re-authenticate when [Assignment: organization-defined circumstances or situations].\nDiscussion: In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},7,[21,25,29,33,37,41,45],{"slug":22,"title":23,"published_at":24},"device-code-phishing-bypasses-mfa-by-abusing-legitimate-microsoft-auth-flow","Device Code Phishing Bypasses MFA by Abusing Legitimate Microsoft Auth Flow","2026-11-13T08:22:33.154+00:00",{"slug":26,"title":27,"published_at":28},"infostealer-claims-to-maintain-gmail-access-beyond-password-resets","Infostealer Claims to Maintain Gmail Access Beyond Password Resets","2026-11-11T12:22:39.713+00:00",{"slug":30,"title":31,"published_at":32},"browser-based-attacks-bypass-edr-by-exploiting-legitimate-sessions","Browser-Based Attacks Bypass EDR by Exploiting Legitimate Sessions","2026-10-02T16:21:18.74+00:00",{"slug":34,"title":35,"published_at":36},"session-hijacking-bypasses-mfa-as-top-identity-threat","Session Hijacking Bypasses MFA as Top Identity Threat","2026-09-10T16:22:56.996+00:00",{"slug":38,"title":39,"published_at":40},"ai-reasoning-apis-leaked-secrets-via-replayable-encrypted-objects","AI Reasoning APIs Leaked Secrets via Replayable Encrypted Objects","2026-08-12T14:21:27.218+00:00",{"slug":42,"title":43,"published_at":44},"mikrotik-routeros-session-flaw-exposes-wireguard-private-keys","MikroTik RouterOS Session Flaw Exposes WireGuard Private Keys","2026-07-30T19:21:17.215+00:00",{"slug":46,"title":47,"published_at":48},"acr-stealer-exploits-clickfix-social-engineering-to-harvest-browser-tokens-and-m365-data","ACR Stealer Exploits ClickFix Social Engineering to Harvest Browser Tokens and M365 Data","2026-07-17T12:21:45.38+00:00",[50,55,59,64,69,73],{"slug":51,"name":52,"problem":53,"stories":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",4,{"slug":56,"name":57,"problem":58,"stories":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":60,"name":61,"problem":62,"stories":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",3,{"slug":65,"name":66,"problem":67,"stories":68},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":70,"name":71,"problem":72,"stories":68},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":74,"name":75,"problem":76,"stories":68},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[78,82,87,92,97,101,105,110],{"family":5,"item":79,"code":80,"title":81,"together":54},"ac-12","AC-12","Session Termination",{"family":83,"item":84,"code":85,"title":86,"together":54},"cis","16","Control 16","Application Software Security",{"family":88,"item":89,"code":90,"title":91,"together":54},"gdpr","32","Article 32","Security of processing",{"family":93,"item":94,"code":95,"title":96,"together":54},"mitre-attack","t1539","T1539","Steal Web Session Cookie",{"family":83,"item":98,"code":99,"title":100,"together":68},"5","Control 5","Account Management",{"family":83,"item":102,"code":103,"title":104,"together":68},"6","Control 6","Access Control Management",{"family":106,"item":107,"code":108,"title":109,"together":68},"nis2","21-2-j","Article 21(2)(j)","Multi-factor authentication and secured communications (Article 21(2)(j))",{"family":5,"item":111,"code":112,"title":113,"together":68},"si-4","SI-4","System Monitoring"]