id: "IA-05(18)" title: "Password Managers" family: "IA" family_name: "Identification and Authentication" sort_id: "ia-05.18" priority: "P1" implementation_level: "system" parent: "IA-05" enhancement: True
Employ {{ insert: param, ia-05.18_odp.01 }} to generate and manage passwords; and
Protect the passwords using {{ insert: param, ia-05.18_odp.02 }}.
Guidance
For systems where static passwords are employed, it is often a challenge to ensure that the passwords are suitably complex and that the same passwords are not employed on multiple systems. A password manager is a solution to this problem as it automatically generates and stores strong and different passwords for various accounts. A potential risk of using password managers is that adversaries can target the collection of passwords generated by the password manager. Therefore, the collection of passwords requires protection including encrypting the passwords (see IA-5(1)(d) ) and storing the collection offline in a token.
Assessment Objective: {{ insert: param, ia-05.18_odp.01 }} are employed to generate and manage passwords;
Assessment Objective: the passwords are protected using {{ insert: param, ia-05.18_odp.02 }}.
Identification and authentication policy
procedures addressing identifier management
system security plan
system design documentation
mechanisms providing dynamic binding of identifiers and authenticators
system configuration settings and associated documentation
system audit records
other relevant documents or records
Organizational personnel with identification and authentication management responsibilities
organizational personnel with information security responsibilities
system/network administrators
Mechanisms supporting and/or implementing account management capability
mechanisms supporting and/or implementing identification and authentication management capabilities for the system