Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application must enforce a 180-day maximum password lifetime restriction.
Description
Discussion Text
Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor common access card (CAC)-enabled authentication.
Examples of situations where a user ID and password might be used include but are not limited to:
- When the application user base does not have a CAC and is not a current DoW employee, member of the military, or a DoW contractor.
- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.
- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.
Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals.
One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.
This requirement does not include emergency administration accounts which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.
Examples of situations where a user ID and password might be used include but are not limited to:
- When the application user base does not have a CAC and is not a current DoW employee, member of the military, or a DoW contractor.
- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.
- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.
Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals.
One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.
This requirement does not include emergency administration accounts which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.