Passwords with at least 20 characters
Summary
System passwords must be at least 20 characters long.
Description
empty
Supported In
This requirement is verified in following services
Plan | Supported |
---|---|
Machine | 🟢 |
Squad | 🟢 |
References
- CAPEC™-49. Password brute forcing
- CAPEC™-560. Use of known domain credentials
- CWE™-521. Weak password requirements
- CWE™-522. Insufficiently protected credentials
- CWE™-640. Weak password recovery mechanism for forgotten password
- CWE™-1391. Use of Weak Credentials
- NERC CIP-007-6_R5_5. System access control
- OWASP TOP 10-A7. Identification and authentication failures
- MITRE ATT&CK®-M1027. Password policies
- PA-DSS-3_1_6. Passwords must meet minimum requirements
- CMMC-IA_L2-3_5_7. Password complexity
- HITRUST CSF-01_d. User password management
- FedRAMP-IA-5_1. Authenticator management - Password-based authentication
- ISA/IEC 62443-IAC-1_7. Strength of password-based authentication
- ISA/IEC 62443-CR-1_7. Strength of password-based authentication
- OSSTMM3-9_9_1. Wireless security (configuration verification) - Common errors
- ISSAF-D_8. Network security - Password security testing (countermeasures)
- ISSAF-D_1. Network security - Password security testing (gathering authentication credentials)
- ISSAF-Y_3_1. Database Security - Database services countermeasures
- PTES-5_5_3. Vulnerability analysis - Common/default passwords
- PTES-7_4_5_1. Post Exploitation - Pillaging (system configuration password policy)
- MVSP-2_4. Application design controls - Password policy
- OWASP SCP-3. Authentication and password management
- OWASP MASVS-V4_5. Authentication and session management requirements - Password policy
- NIST 800-171-5_2. Authenticate or verify the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- NIST 800-171-5_7. Enforce a minimum password complexity and change of characters when new passwords are created
- NIST 800-115-5_1. Password cracking
- SWIFT CSCF-4_1. Password policy
- OWASP ASVS-2_1_1. Password security
- C2M2-4_1_d. Establish identities and manage authentication
- PCI DSS-8_3_6. Passwords or passphrases with minimum level of complexity
- SIG Lite-SL_72. Is there a password policy for systems that transmit, process or store data that has been approved by management on all platforms?
- SIG Core-H_3_1_6. Access control
- SIG Core-U_1_9_11. Server security
- OWASP ASVS-2_1_3. Password security
- OWASP ASVS-2_1_4. Password security
- OWASP ASVS-2_1_8. Password security
- OWASP ASVS-2_1_9. Password security
- Resolution SB 2021 2126-Art_30_7. Security in Electronic Channels - Digital Banking
Vulnerabilities
- 035. Weak credential policy
- 050. Guessed weak credentials
- 277. Weak credential policy - Password Expiration
- 296. Weak credential policy - Password Change Limit
- 363. Weak credential policy - Password strength
- 364. Weak credential policy - Temporary passwords
free trial
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.