Prevent the use of breached passwords
Summary
The system must check new passwords against a list of 1,000 to 10,000 breached passwords.
Description
There are various mechanisms for cracking passwords that use public lists containing breached credentials. Systems must check submitted passwords against some of these lists and prevent account creation and password update operations that use passwords contained in them.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🟢 |
| Advanced | 🟢 |
References
- CAPEC™-16. Dictionary-based password attack
- CAPEC™-560. Use of known domain credentials
- CWE™-521. Weak password requirements
- CWE™-640. Weak password recovery mechanism for forgotten password
- CWE™-1391. Use of Weak Credentials
- NIST 800-63B-5_1_1_2. Memorized secret verifiers
- OWASP TOP 10-A7. Identification and authentication failures
- MITRE ATT&CK®-M1027. Password policies
- CMMC-IA_L2-3_5_8. Password reuse
- HITRUST CSF-01_d. User password management
- ISA/IEC 62443-IAC-1_7. Strength of password-based authentication
- ISSAF-D_8. Network security - Password security testing (countermeasures)
- ISSAF-D_1. Network security - Password security testing (gathering authentication credentials)
- ISSAF-U_9. Web application SQL injections - Bypass user authentication
- PTES-5_5_3. Vulnerability analysis - Common/default passwords
- MVSP-2_4. Application design controls - Password policy
- OWASP SCP-3. Authentication and password management
- NIST 800-115-5_1. Password cracking
- SWIFT CSCF-4_1. Password policy
- OWASP ASVS-2_1_7. Password security
- SIG Lite-SL_72. Is there a password policy for systems that transmit, process or store data that has been approved by management on all platforms?
Vulnerabilities
- 035. Weak credential policy
- 277. Weak credential policy - Password Expiration
- 296. Weak credential policy - Password Change Limit
- 363. Weak credential policy - Password strength
- 364. Weak credential policy - Temporary passwords
free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.