Application/service account passwords must be changed at least annually or whenever a system administrator with knowledge of the password leaves the organization.

From MAC OSX 10.6 Workstation Security Technical Implementation Guide

Part of OSX00695-Application Account Passwords

Associated with IA controls: ECPA-1

SV-37329r1_rule Application/service account passwords must be changed at least annually or whenever a system administrator with knowledge of the password leaves the organization.

Vulnerability discussion

Setting application accounts to expire may cause applications to stop functioning. The site will have a policy for application account passwords manually generated and entered by a system administrator to be changed at least annually or when a system administrator with knowledge of the password leaves the organization. Application/service account passwords will be at least 15 characters and follow complexity requirements for all passwords.

Check content

The site should have a local policy ensuring passwords for application/service accounts are at least 15 characters in length and meet complexity requirements for all passwords. Application/service account passwords manually generated and entered by a system administrator must be changed at least annually or whenever a system administrator with knowledge of the password leaves the organization. Interview the system administrators on their policy for application/service accounts. If it does not meet the above requirements, this is a finding.

Fix text

Create application/service account passwords at least 15 characters in length and meet complexity requirements. Change of application/service account passwords are manually generated and entered by a system administrator at least annually or whenever an administrator with knowledge of the password leaves the organization.

Pro Tips

Powered by sagemincer