Detections
Analytics
800-53|IA-5(1)
Title
PASSWORD-BASED AUTHENTICATIONDescription
The information system, for password-based authentication:Supplemental
This control enhancement applies to single-factor authentication of individuals using passwords as individual or group authenticators, and in a similar manner, when passwords are part of multifactor authenticators. This control enhancement does not apply when passwords are used to unlock hardware authenticators (e.g., Personal Identity Verification cards). The implementation of such password mechanisms may not meet all of the requirements in the enhancement. Cryptographically-protected passwords include, for example, encrypted versions of passwords and one-way cryptographic hashes of passwords. The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. Password lifetime restrictions do not apply to temporary passwords. To mitigate certain brute force attacks against passwords, organizations may also consider salting passwords.Reference Item Details
Reference: NIST 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations
Related: IA-6
Category: IDENTIFICATION AND AUTHENTICATION
Parent Title: AUTHENTICATOR MANAGEMENT
Family: IDENTIFICATION AND AUTHENTICATION
Baseline Impact: LOW,MODERATE,HIGH
Audit Items
View all Reference Audit Items