Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application must transmit only cryptographically-protected passwords.
Description
Discussion Text
Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.
Examples of situations where a user ID and password might be used include but are not limited to:
- When the application user base does not have a CAC and is not a current DoW employee, member of the military, or a DoW contractor.
- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.
and
- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.
Passwords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.
Applications can accomplish this by making direct function calls to encryption modules or by leveraging operating system encryption capabilities.
Examples of situations where a user ID and password might be used include but are not limited to:
- When the application user base does not have a CAC and is not a current DoW employee, member of the military, or a DoW contractor.
- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.
and
- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.
Passwords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.
Applications can accomplish this by making direct function calls to encryption modules or by leveraging operating system encryption capabilities.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.