Summary

The system must check new passwords against a list of 1,000 to 10,000 breached passwords.

Description

There are various mechanisms for cracking passwords that use public lists containing breached credentials. Systems must check submitted passwords against some of these lists and prevent account creation and password update operations that use passwords contained in them.

References

• CAPEC-16. Dictionary-based password attack
• CAPEC-560. Use of known domain credentials
• CWE-521. Weak password requirements
• CWE-640. Weak password recovery mechanism for forgotten password
• CWE-1391. Use of Weak Credentials
• NIST80063-5_1_1_2. Memorized secret verifiers
• OWASP10-A7. Identification and authentication failures
• MITRE-M1027. Password policies
• CMMC-IA_L2-3_5_8. Password reuse
• HITRUST-01_d. User password management
• IEC62443-IAC-1_7. Strength of password-based authentication
• ISSAF-D_8. Network security - Password security testing (countermeasures)
• ISSAF-D_1. Network security - Password security testing (gathering authentication credentials)
• ISSAF-U_9. Web application SQL injections - Bypass user authentication
• PTES-5_5_3. Vulnerability analysis - Common/default passwords
• MVSP-2_4. Application design controls - Password policy
• OWASPSCP-3. Authentication and password management
• NIST800115-5_1. Password cracking
• SWIFTCSC-4_1. Password policy
• ASVS-2_1_7. Password security
• SIGLITE-SL_72. Is there a password policy for systems that transmit, process or store data that has been approved by management on all platforms?

Weaknesses

• 035. Weak credential policy
• 277. Weak credential policy - Password Expiration
• 296. Weak credential policy - Password Change Limit
• 363. Weak credential policy - Password strength
• 364. Weak credential policy - Temporary passwords