DoD STIGs – V-32474

Overview:

Title: The DBMS must enforce password maximum lifetime restrictions.

Vulnerability ID: V-32474

STIG ID:

IA Controls: None

Severity: medium

Description: Password maximum lifetime is the maximum period of time, (typically in days) a user’s password may be in effect before the user is forced to change it.

Passwords need to be changed at specific policy based intervals as per policy. Any password no matter how complex can eventually be cracked.

One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords there is the risk that the system and/or application passwords could be compromised.

Check Text: Review DBMS settings to determine if passwords must be changed periodically. If not, this is a finding.

Fix Text: Modify DBMS settings to force users to periodically change their passwords.

[divider]

Interpreting V-32474:

Coming Soon!

Return to the DoD STIGs – Database Security Requirements Guide

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.