Overview
  1. 03.01: Access Control
  2. 03.02: Awareness and Training
  3. 03.03: Audit and Accountability
  4. 03.04: Configuration Management
  5. 03.05: Identification and Authentication
  6. 03.06: Incident Response
  7. 03.07: Maintenance
  8. 03.08: Media Protection
  9. 03.09: Personnel Security
  10. 03.10: Physical Protection
  11. 03.11: Risk Assessment
  12. 03.12: Security Assessment and Monitoring
  13. 03.13: System and Communications Protection
  14. 03.14: System and Information Integrity
  15. 03.15: Planning
  16. 03.16: System and Services Acquisition
  17. 03.17: Supply Chain Risk Management

Security Requirements for 03.05.07 Password Management

Password-based authentication applies to passwords used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable to shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish and enforce certain rules for password generation (e.g., minimum character length) under certain circumstances. For example, account recovery can occur when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof. Changing temporary passwords to permanent passwords immediately after system logon ensures that the necessary strength of the authentication mechanism is implemented at the earliest opportunity and reduces susceptibility to authenticator compromises. Long passwords and passphrases can be used to increase the complexity of passwords.

Evidence

  1. 03.05.07.a

    Maintain a list of commonly-used, expected, or compromised passwords, and update the list at least quarterly and when organizational passwords are suspected to have been compromised.

  1. 03.05.07.b

    Verify that passwords are not found on the list of commonly used, expected, or compromised passwords when users create or update passwords.

  1. 03.05.07.c

    Transmit passwords only over cryptographically protected channels.

  1. 03.05.07.d

    Store passwords in a cryptographically protected form.

  1. 03.05.07.e

    Select a new password upon first use after account recovery.

  1. 03.05.07.f

    Enforce the following composition and complexity rules for passwords: 1) Must have a minimum length of 16 characters. 2) Contains a string of characters that does not include the user’s account name or full name..