Requirement
Store and transmit only cryptographically protected passwords.
Assessment Objectives
- Passwords are cryptographically protected in storage
- Passwords are cryptographically protected in transit
Potential Assessment Methods and Objects [NIST SP 800-171A]
Examine
- Identification and authentication policy
- System security plan
- Procedures addressing authenticator management
- Procedures addressing user identification and authentication
- System design documentation
- List of system authenticator types
- System configuration settings and associated documentation
- Change control records associated with managing system authenticators
- System audit logs and records
- Other relevant documents or records
Interview
- Personnel with authenticator management responsibilities
- Personnel with information security responsibilities
- System or network administrators
Test
- Mechanisms supporting or implementing authenticator management capability
Discussion [NIST SP 800-171 REV. 2]
Cryptographically-protected passwords use salted one-way cryptographic hashes of passwords. See NIST Cryptographic Standards and Guidelines.
Further Discussion
All passwords must be cryptographically protected using a one-way function for storage and transmission. This type of protection changes passwords into another form, or a hashed password. A one-way transformation makes it theoretically impossible to turn the hashed password back into the original password, but inadequate complexity (IA.L2-3.5.7) may still facilitate offline cracking of hashes.
Examples
Example 1
You are responsible for managing passwords for your organization. You protect all passwords with a one-way transformation, or hashing, before storing them. Passwords are never transmitted across a network unencrypted [a,b].
Potential Assessment Considerations
- Are passwords prevented from being stored in reversible encryption form in any company systems [a]?
- Are passwords stored as one-way hashes constructed from passwords [a]?
References
- NIST SP 800-171 Rev. 2 3.5.10
