SI-3(9) — Authenticate Remote Commands

Authenticate remote commands before executing them to prevent attackers from sending unauthorized instructions to your systems.

Example 1: Configure Windows Remote Management (WinRM) to require Kerberos authentication. Remote PowerShell sessions must authenticate with valid domain credentials before any commands are accepted. Do not allow basic authentication or unencrypted connections.

Example 2: For SSH access to Linux servers, disable password authentication and require SSH key-based authentication with a passphrase. This ensures only users with the correct private key can issue remote commands.