Title

The system must require that passwords contain a minimum of 14 characters. (Cat II impact)

Discussion

The use of longer passwords reduces the ability of attackers to successfully obtain valid passwords using guessing or exhaustive search techniques by increasing the password search space.

Check Content

Check the system minimum password length setting. If the setting is not 14 or greater, this is a finding.

Fix Text

Set the system minimum password length setting to 14 or greater.

Additional Identifiers

Rule ID: SV-12448r2_rule

Vulnerability ID: V-11947

Group Title: GEN000580

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.