The product does not require that users should have strong
passwords, which makes it easier for attackers to compromise user
accounts.
Extended Description
An authentication mechanism is only as strong as its credentials. For this
reason, it is important to require users to have strong passwords. Lack of
password complexity significantly reduces the search space when trying to
guess user's passwords, making brute-force attacks easier.
Time of Introduction
Architecture and Design
Implementation
Potential Mitigations
Phase
Description
Architecture and Design
Enforce usage of strong passwords. A password strength policy should
contain the following attributes: (1) Minimum and maximum length; (2)
Require mixed character sets (alpha, numeric, special, mixed case); (3)
Do not contain user name; (4) Expiration; (5) No password reuse.
Architecture and Design
Authentication mechanisms should always require sufficiently complex
passwords and require that they be periodically changed.
Description
