NIST Special Publication 800-171 Revision 2

Date Published: January 28th, 2021

Withdrawn on May 14, 2024. Superseded by SP 800-171 Rev. 3

Author(s): Ron Ross (NIST), Victoria Pillitteri (NIST), Kelley Dempsey (NIST), Mark Riddle (NARA), Gary Guissanie (IDA)

Note: A Class Deviation is in effect as of May 2, 2024 (DEVIATION 2024O0013). The deviation clause requires contractors, who are subject to 252.204-7012, to comply with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2, instead of the version of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the contracting officer. Click Here

3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created.

Control Family: Identification and Authentication

Control Type: Derived

SPRS Value: 1

SPRS Supplemental Guidance: N/A

CMMC Level(s): IA.L2-3.5.7

Top Ten Failed Requirement: No

DIBCAC HIGH Failure Rate (OTS):

74th of 110

Referenced in:

DFARS 252.204-7012

Derived From: NIST SP 800-53r4

  • IA-5(1)

NIST Supplemental Guidance:

N/A

NIST SP 800-171r2 Control 3.5.7 → MITRE ATT&CK 14.1

NIST SP 800-171r2 Control 3.5.7 → MITRE ATT&CK 14.1

Mapping note: MITRE ATT&CK 14.1 techniques are derived through the NIST SP 800-53 Rev. 4 controls mapped to each NIST SP 800-171 Rev. 2 requirement.

Summary

  • Total mappings: 68
  • Families: 1
  • Outer ring: Technique ID + name
  • MITRE ATT&CK version: 14.1

Family counts

  • Authenticator Management: 68 techniques

Usage notes

  • Click a family or technique to zoom in.
  • Click the center to zoom back out.
  • Hover to view technique details.

Discussion:

This requirement applies to single-factor authentication of individuals using passwords as individual or group authenticators, and in a similar manner, when passwords are used as part of multifactor authenticators. The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. To mitigate certain brute force attacks against passwords, organizations may also consider salting passwords.

Determining Statements (NIST SP 800-171Ar2)

3.5.7[a] password complexity requirements are defined.
3.5.7[b] password change of character requirements are defined.
3.5.7[c] minimum password complexity requirements as defined are enforced when
new passwords are created.
3.5.7[d] minimum password change of character requirements as defined are enforced
when new passwords are created.

Assessors are instructed to-

Examine: [SELECT FROM: Identification and authentication policy; password policy; procedures addressing authenticator management; system security plan; system configuration settings and associated documentation; system design documentation; password configurations and associated documentation; other relevant documents or records].

Interview: [SELECT FROM: Personnel with authenticator management responsibilities; personnel with information security responsibilities; system or network administrators; system developers].

Test: [SELECT FROM: Mechanisms supporting or implementing password-based authenticator management capability].

FURTHER DISCUSSION

Password complexity means using different types of characters as well as a specified number of characters. This applies to both the creation of new passwords and the modification of existing passwords. Characters to manage complexity include numbers, lowercase and uppercase letters, and symbols. Minimum complexity requirements are left up to the organization to define. Define the lowest level of password complexity required. Define the number of characters that must be changed when an existing password is changed. Enforce these rules for all passwords. Salting passwords adds a string of random characters (salt) to a password prior to hashing. This ensures the randomness of the resulting hash value.

Example

You work with management to define password complexity rules and ensure they are listed in the company’s security policy. You define and enforce a minimum number of characters for each password and ensure that a certain number of characters must be changed when updating passwords [a,b]. Characters include numbers, lowercase and uppercase letters, and symbols [a]. These rules help create hard-to-guess passwords, which help to secure your network.

Potential Assessment Considerations

  • Is a degree of complexity specified for passwords, (e.g., are account passwords a minimum of 12 characters and a mix of upper/lower case, numbers, and special characters), including minimum requirements for each type [a,b,c]?

  • Is a change of characters required when new passwords are created [d]?

ISO/IEC 27001:2013

No direct mapping

NIST SP 800-171r2 Control 3.5.7 → MITRE ATT&CK
MITRE ATT&CK v14.1

NIST SP 800-171r2 Control 3.5.7 → MITRE ATT&CK

Total Mappings

68
technique references

Families

1
Authenticator Management

Control

3.5.7
IA.L2-3.5.7

Authenticator Management 68 techniques

  • T1003OS Credential Dumping
  • T1003.001LSASS Memory
  • T1003.002Security Account Manager
  • T1003.003NTDS
  • T1003.004LSA Secrets
  • T1003.005Cached Domain Credentials
  • T1003.006DCSync
  • T1003.007Proc Filesystem
  • T1003.008/etc/passwd and /etc/shadow
  • T1021Remote Services
  • T1021.001Remote Desktop Protocol
  • T1021.004SSH
  • T1040Network Sniffing
  • T1072Software Deployment Tools
  • T1078Valid Accounts
  • T1078.002Domain Accounts
  • T1078.004Cloud Accounts
  • T1098.001Additional Cloud Credentials
  • T1098.002Exchange Email Delegate Permissions
  • T1098.003Add Office 365 Global Administrator Role
  • T1098.004SSH Authorized Keys
  • T1110Brute Force
  • T1110.001Password Guessing
  • T1110.002Password Cracking
  • T1110.003Password Spraying
  • T1110.004Credential Stuffing
  • T1111Two-Factor Authentication Interception
  • T1114Email Collection
  • T1114.002Remote Email Collection
  • T1133External Remote Services
  • T1136Create Account
  • T1136.001Local Account
  • T1136.002Domain Account
  • T1136.003Cloud Account
  • T1528Steal Application Access Token
  • T1530Data from Cloud Storage Object
  • T1539Steal Web Session Cookie
  • T1550.003Pass the Ticket
  • T1552Unsecured Credentials
  • T1552.001Credentials In Files
  • T1552.002Credentials in Registry
  • T1552.004Private Keys
  • T1552.006Group Policy Preferences
  • T1555Credentials from Password Stores
  • T1555.001Keychain
  • T1555.002Securityd Memory
  • T1555.004Windows Credential Manager
  • T1555.005Password Managers
  • T1556Modify Authentication Process
  • T1556.001Domain Controller Authentication
  • T1556.003Pluggable Authentication Modules
  • T1556.004Network Device Authentication
  • T1556.005Reversible Encryption
  • T1558Steal or Forge Kerberos Tickets
  • T1558.001Golden Ticket
  • T1558.002Silver Ticket
  • T1558.003Kerberoasting
  • T1558.004AS-REP Roasting
  • T1559Inter-Process Communication
  • T1559.001Component Object Model
  • T1563.001SSH Hijacking
  • T1599Network Boundary Bridging
  • T1599.001Network Address Translation Traversal
  • T1601Modify System Image
  • T1601.001Patch System Image
  • T1601.002Downgrade System Image
  • T1621Multi-Factor Authentication Request Generation
  • T1649Steal or Forge Authentication Certificates

Frameworks & Controls