The IDPS must enforce the number of characters changed when passwords are changed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34676	SRG-NET-000159-IDPS-00117	SV-45553r1_rule		Low

Description

To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organizationally defined frequency. Password strength is a measure of the effectiveness of a password in resisting guessing, dictionary attacks, as well as, brute-force attacks. When users change the password, the system must ensure the new password is not too similar to the previously used password (s). This control applies to passwords configured or controlled by the IDPS itself.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42902r1_chk )

If authentication functionality is provided by the underlying platform's account management system or by a network authentication server rather than the IDPS application itself, this is not a finding. Verify an organizationally defined value is set for the number of characters that must be changed when passwords are changed. If an organizationally defined value is not set for the number of characters that must be different between the new password and the previously used password, this is a finding.

Fix Text (F-38950r1_fix)
Set an organizationally defined value for the number of characters that must be different between the new password and the previously used password.