Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application must allow the use of a temporary password for system logons with an immediate change to a permanent password.
Description
Discussion Text
Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.
Examples of situations where a user ID and password might be used include but are not limited to:
- When the application user base does not have a CAC and is not a current DoW employee, member of the military, or a DoW contractor.
- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.
- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.
Without providing this capability, an account may be created without a password. Nonrepudiation cannot be guaranteed once an account is created if a user is not forced to change the temporary password upon initial logon.
Temporary passwords are typically used to allow access to applications when new accounts are created or passwords are changed. It is common practice for administrators to create temporary passwords for user accounts which allow the users to log on, yet force them to change the password once they have successfully authenticated.
Examples of situations where a user ID and password might be used include but are not limited to:
- When the application user base does not have a CAC and is not a current DoW employee, member of the military, or a DoW contractor.
- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.
- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.
Without providing this capability, an account may be created without a password. Nonrepudiation cannot be guaranteed once an account is created if a user is not forced to change the temporary password upon initial logon.
Temporary passwords are typically used to allow access to applications when new accounts are created or passwords are changed. It is common practice for administrators to create temporary passwords for user accounts which allow the users to log on, yet force them to change the password once they have successfully authenticated.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.