Title

User passwords are displayed in the clear when logging into the system. (Cat II impact)

Discussion

Requirement: The IAO will ensure that users’ passwords are not displayed in the clear when logging into the system. When passwords are displayed (echoed) during logon, the risk of password compromise is increased and password confidentiality is greatly reduced. If the password is displayed during logon, it can be easily compromised through the use of a simple technique of shoulder surfing.

Check Content

Have the IAO or SA demonstrate compliance with the requirement; minimally on a sampling of the related or effected devices. Inspect configuration files as applicable.

Fix Text

Ensure systems are configured not to display passwords in the clear during logon. If hardware or firmware restrict the implementation of this function, upgrade as soon as possible.

Additional Identifiers

Rule ID: SV-8453r1_rule

Vulnerability ID: V-7967

Group Title: Passwords are displayed in the clear at logon

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.