Windows Phone 8.1 must be configured to implement the management setting: Not allow the device unlock password to contain more than two sequential or repeating characters (e.g., 456, aaa).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58955	MSWP-81-500802	SV-73385r1_rule		Medium

Description
Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute-force attack. Passwords with sequential or repeating numbers or alphabetic characters (e.g., 456, 987, 222, abc, ddd) are considered easier to crack than random patterns. Therefore, disallowing sequential or repeating numbers or alphabetic characters makes it more difficult for an adversary to discover the password. SFR ID: FMT_SMF.1.1 #42

Description

Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute-force attack. Passwords with sequential or repeating numbers or alphabetic characters (e.g., 456, 987, 222, abc, ddd) are considered easier to crack than random patterns. Therefore, disallowing sequential or repeating numbers or alphabetic characters makes it more difficult for an adversary to discover the password. SFR ID: FMT_SMF.1.1 #42

STIG	Date
Microsoft Windows Phone 8.1 Security Technical Implementation Guide	2015-03-26

Details

Check Text ( C-59785r1_chk )
This validation procedure is performed on both the MDM administration console and the Windows Phone mobile device. On the MDM administration console: 1. Ask the MDM administrator to verify the phone compliance policy. 2. Find the setting for "Require simple password, no repeating or pattern based passwords". 3. Verify that setting restriction is turned off/disallowed. This validation procedure is performed on the Windows Phone mobile device. On the Windows Phone mobile device: 1.Wait for the MDM policy to be applied. 2. When prompted that the password policy has changed, attempt to set a password that is either 111111 or 123456. 3. Verify that those password types are not allowed. If the MDM system does not enforce a password policy that disables "Require simple password, no repeating or pattern based passwords" or, on the phone, creating simple password is allowed, this is a finding.

Check Text ( C-59785r1_chk )

This validation procedure is performed on both the MDM administration console and the Windows Phone mobile device.

On the MDM administration console:
1. Ask the MDM administrator to verify the phone compliance policy.
2. Find the setting for "Require simple password, no repeating or pattern based passwords".
3. Verify that setting restriction is turned off/disallowed.

This validation procedure is performed on the Windows Phone mobile device.

On the Windows Phone mobile device:
1.Wait for the MDM policy to be applied.
2. When prompted that the password policy has changed, attempt to set a password that is either 111111 or 123456.
3. Verify that those password types are not allowed.

If the MDM system does not enforce a password policy that disables "Require simple password, no repeating or pattern based passwords" or, on the phone, creating simple password is allowed, this is a finding.

Fix Text (F-64349r1_fix)
Configure the MDM system to enforce a password policy that disables "Require simple password, no repeating or pattern based passwords". Deploy the policy on managed devices.