332 – Prevent the use of breached passwords
Summary
The system must check new passwords against a list of 1,000 to 10,000 breached passwords.
Description
There are various mechanisms for cracking passwords that use public lists containing breached credentials. Systems must check submitted passwords against some of these lists and prevent account creation and password update operations that use passwords contained in them.
Supported In
Essential: True
Advanced: True
References
- CAPEC-16. Dictionary-based password attack
- CAPEC-560. Use of known domain credentials
- CWE-521. Weak password requirements
- CWE-640. Weak password recovery mechanism for forgotten password
- CWE-1391. Use of Weak Credentials
- NIST80063-5_1_1_2. Memorized secret verifiers
- OWASP10-A7. Identification and authentication failures
- MITRE-M1027. Password policies
- CMMC-IA_L2-3_5_8. Password reuse
- HITRUST-01_d. User password management
- IEC62443-IAC-1_7. Strength of password-based authentication
- ISSAF-D_8. Network security - Password security testing (countermeasures)
- ISSAF-D_1. Network security - Password security testing (gathering authentication credentials)
- ISSAF-U_9. Web application SQL injections - Bypass user authentication
- PTES-5_5_3. Vulnerability analysis - Common/default passwords
- MVSP-2_4. Application design controls - Password policy
- OWASPSCP-3. Authentication and password management
- NIST800115-5_1. Password cracking
- SWIFTCSC-4_1. Password policy
- ASVS-2_1_7. Password security
- SIGLITE-SL_72. Is there a password policy for systems that transmit, process or store data that has been approved by management on all platforms?
Weaknesses
Last updated
2023/09/18