STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must require the change of at least 8 of the total number of characters when passwords are changed.

DISA Rule

SV-222541r508029_rule

Vulnerability Number

V-222541

Group Title

SRG-APP-000170

Rule Version

APSC-DV-001730

Severity

CAT II

CCI(s)

• CCI-000195 - The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.

Weight

10

Fix Recommendation

Configure the application to require the change of at least 8 characters in the password when passwords are changed.

Check Contents

Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.

If the application does not use passwords, the requirement is not applicable.

Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities.

When prompted to provide the password, attempt to change less than 8 characters of the total number of characters in the password.

If less than 8 characters of the password are changed, this is a finding.

Vulnerability Number

V-222541

Documentable

False

Rule Version

APSC-DV-001730

Severity Override Guidance

Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.

If the application does not use passwords, the requirement is not applicable.

Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities.

When prompted to provide the password, attempt to change less than 8 characters of the total number of characters in the password.

If less than 8 characters of the password are changed, this is a finding.

Check Content Reference

M

Target Key

4093

Comments