134 – Store passwords with salt

Summary

The system must store passwords with different key derivations (salt).

Description

The use of salts introduces an extra layer of complexity for attackers attempting to crack password hashes. This requirement is a fundamental practice for protecting user credentials, mitigating common attack vectors, such as rainbow tables, dictionary or brute force attacks.

Supported In

Essential: True

Advanced: True

References

• CIS-3_11. Encrypt sensitive data at rest
• CWE-522. Insufficiently protected credentials
• CWE-759. Use of a one-way hash without a salt
• CWE-760. Use of a one-way hash with a predictable salt
• CWE-916. Use of password hash with insufficient computational effort
• NIST80063-5_1_1_2. Memorized secret verifiers
• CMMC-IA_L2-3_5_10. Cryptographically-protected passwords
• ISSAF-D_8. Network security - Password security testing (countermeasures)
• ISSAF-Q_16_10. Host security - Windows security (SMB attacks)
• MVSP-2_4. Application design controls - Password policy
• OWASPSCP-3. Authentication and password management
• BSAFSS-SI_1-5. Avoid architectural weaknesses of authentication failure
• NIST800171-5_10. Store and transmit only cryptographically-protected passwords
• CWE25-798. Use of hard-coded credentials
• ASVS-2_4_1. Credential storage
• C2M2-4_1_d. Establish identities and manage authentication
• ASVS-2_10_3. Service authentication
• OWASPAPI-API8. Security Misconfiguration
• CASA-2_4_1. Credential Storage
• CASA-2_10_3. Service Authentication
• SANS25-18. Use of hard-coded credentials

Weaknesses

• 245 – Non-encrypted confidential information - Credit Cards
• 246 – Non-encrypted confidential information - DB
• 247 – Non-encrypted confidential information - AWS
• 248 – Non-encrypted confidential information - LDAP
• 249 – Non-encrypted confidential information - Credentials
• 251 – Non-encrypted confidential information - JFROG
• 275 – Non-encrypted confidential information - Local data
• 284 – Non-encrypted confidential information - Base 64
• 378 – Non-encrypted confidential information - Hexadecimal
• 385 – Non-encrypted confidential information - Keys
• 386 – Cross-Site Leak - Frame Counting
• 441 – Non-encrypted confidential information - Azure
• 020 – Non-encrypted confidential information
• 051 – Cracked weak credentials
• 095 – Data uniqueness not properly verified
• 099 – Non-encrypted confidential information - S3 Server Side Encryption

Last updated

2024/02/05