+IA-05(18) Password Managers
|
IA-05(18) Password Managers
Control
- Employ [Assignement: password managers] to generate and manage passwords; and
- Protect the passwords using [Assignement: controls].
Discussion
For systems where static passwords are employed, it is often a challenge to ensure that the passwords are suitably complex and that the same passwords are not employed on multiple systems. A password manager is a solution to this problem as it automatically generates and stores strong and different passwords for various accounts. A potential risk of using password managers is that adversaries can target the collection of passwords generated by the password manager. Therefore, the collection of passwords requires protection including encrypting the passwords (see [IA-5(1)(d)](#ia-5.1_smt.d) ) and storing the collection offline in a token.
Assessment Objective
- [Assignement: password managers] are employed to generate and manage passwords;
- the passwords are protected using [Assignement: controls].
Assessment Method
Examine
Identification and authentication policy
procedures addressing identifier management
system security plan
system design documentation
mechanisms providing dynamic binding of identifiers and authenticators
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with identification and authentication management responsibilities
organizational personnel with information security responsibilities
system/network administrators
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|