Allowing password aging to occur unchecked can result in the possibility of diminished password integrity.
Extended Description
Just as neglecting to include functionality for the management of password aging is dangerous, so is allowing password aging to continue unchecked. Passwords must be given a maximum life span, after which a user is required to update with a new and different password.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Gain privileges / assume
identity
As passwords age, the probability that they are compromised
grows.
Likelihood of Exploit
Very Low
Demonstrative Examples
Example 1
A common example is not having a system to terminate old employee
accounts.
Example 2
Not having a system for enforcing the changing of passwords every
certain period.
Potential Mitigations
Phase: Architecture and Design
Ensure that password aging is limited so that there is a defined
maximum age for passwords and so that the user is notified several times
leading up to the password expiration.
[REF-17] Michael Howard, David LeBlanc
and John Viega. "24 Deadly Sins of Software Security". "Sin 19: Use of Weak Password-Based Systems." Page
279. McGraw-Hill. 2010.
Description
