The application must enforce a 60-day maximum password lifetime restriction.
From Application Security and Development Security Technical Implementation Guide
Part of SRG-APP-000174
Associated with:
CCI-000199
SV-84195r1_rule
The application must enforce a 60-day maximum password lifetime restriction.
Vulnerability discussion
Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.Examples of situations where a user ID and password might be used include but are not limited to:- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor.- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.and- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals.One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.This requirement does not include emergency administration accounts which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.
Check content
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.
If the application does not use passwords, the requirement is not applicable.
Access the application management interface and view the user password settings page.
Review user password settings and validate the application is configured to expire and force a password change after 60 days.
If user passwords are not configured to expire after 60 days, or if the application does not have the ability to control this setting, this is a finding.
Fix text
Configure the application to have a maximum password lifetime of 60 days.
Pro Tips
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer