All,
While we’re on the topic of source policies, I’ve been trying to track down the reasoning for the 15 character minimum. I’m sure it’s not conjured from nowhere, but the only policy I’ve found that dictates minimum password length [IA-5(1)] is CNSSI-1253 (Dated Mar 2014) that says 12 characters minimum.
“A case sensitive 12-character mix of upper case letters, lower case letters, numbers and special characters in including at least one of each.”
I checked the classified and intelligence overlays, and didn’t see any reference to the control. So, can anyone point me to a policy that leads to 15 characters being in the STIG?
Tom A.
Thomas Albrecht III, CISSP-ISSEP, RHCSA Cyber Architect | Cyber Insidehttps://insidelm.external.lmco.com/cyber-inside |CAS2T Lockheed Martin, Rotary and Mission Systems (RMS) 230 Mall Blvd, | King of Prussia, PA [m] 610-906-4356 cyber.security@lmco.commailto:cyber.security@lmco.com [cid:image003.png@01D030AD.9DBE6340]
Tom, I wouldn't be surprised if the JSIG and ICDs specifically call out 14+ for a length. An AFMAN may require it too. Just one more way that an AO wants us to tailor SCAP content only when it suits their needs.
Charlie Todd Ball Aerospace
On Jan 10, 2019, at 9:12 PM, Albrecht, Thomas C <thomas.c.albrecht@lmco.commailto:thomas.c.albrecht@lmco.com> wrote:
All,
While we're on the topic of source policies, I've been trying to track down the reasoning for the 15 character minimum. I'm sure it's not conjured from nowhere, but the only policy I've found that dictates minimum password length [IA-5(1)] is CNSSI-1253 (Dated Mar 2014) that says 12 characters minimum.
"A case sensitive 12-character mix of upper case letters, lower case letters, numbers and special characters in including at least one of each."
I checked the classified and intelligence overlays, and didn't see any reference to the control. So, can anyone point me to a policy that leads to 15 characters being in the STIG?
Tom A.
Thomas Albrecht III, CISSP-ISSEP, RHCSA Cyber Architect | Cyber Insidehttps://urldefense.proofpoint.com/v2/url?u=https-3A__insidelm.external.lmco.com_cyber-2Dinside&d=DwMGaQ&c=jF7FvYH6t0RX1HrEjVCgHQ&r=EtM8rzsgMR2aFrLOrhF8eg&m=N41igdOMybjbGaUm_ni-2i9VQB3EvDwtNtNcYj3V0l4&s=PR52BlqRiP30sUIB4_Z11Ymdx8l9H7I5egP5L6Szhfk&e= |CAS2T Lockheed Martin, Rotary and Mission Systems (RMS) 230 Mall Blvd, | King of Prussia, PA [m] 610-906-4356 cyber.security@lmco.commailto:cyber.security@lmco.com <image001.png>
_______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.orgmailto:scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.orgmailto:scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://urldefense.proofpoint.com/v2/url?u=https-3A__getfedora.org_code-2Dof... List Guidelines: https://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wiki_... List Archives: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.org_...
This message and any enclosures are intended only for the addressee. Please notify the sender by email if you are not the intended recipient. If you are not the intended recipient, you may not use, copy, disclose, or distribute this message or its contents or enclosures to any other person and any such actions may be unlawful. Ball reserves the right to monitor and review all messages and enclosures sent to or from this email address.
SP 800-53 IA-5 (1)(a) globalized to 14+ due to the LM hash factor?
On Fri 11 Jan 2019 at 03:12, Albrecht, Thomas C thomas.c.albrecht@lmco.com wrote:
All,
While we’re on the topic of source policies, I’ve been trying to track down the reasoning for the 15 character minimum. I’m sure it’s not conjured from nowhere, but the only policy I’ve found that dictates minimum password length [IA-5(1)] is CNSSI-1253 (Dated Mar 2014) that says 12 characters minimum.
“A case sensitive 12-character mix of upper case letters, lower case letters, numbers and special characters in including at least one of each.”
I checked the classified and intelligence overlays, and didn’t see any reference to the control. So, can anyone point me to a policy that leads to 15 characters being in the STIG?
Tom A.
*Thomas Albrecht III*, CISSP-ISSEP, RHCSA
Cyber Architect | Cyber Inside https://insidelm.external.lmco.com/cyber-inside |CAS2T
Lockheed Martin, Rotary and Mission Systems (RMS)
230 Mall Blvd, | King of Prussia, PA
[m] 610-906-4356
cyber.security@lmco.com
[image: cid:image003.png@01D030AD.9DBE6340]
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor...
I haven't checked just yet, but I believe the password length information is within the OF A 500-27 and possibly within the CNSSI 1253 Appendix J (depending on customer requirements.
Get Outlook for Androidhttps://aka.ms/ghei36
________________________________ From: Jerome Athias athiasjerome@gmail.com Sent: Friday, January 11, 2019 2:27:20 PM To: SCAP Security Guide Cc: Shawn Wells Subject: Re: Minimum Password Length (15 vs 12)
SP 800-53 IA-5 (1)(a) globalized to 14+ due to the LM hash factor?
On Fri 11 Jan 2019 at 03:12, Albrecht, Thomas C <thomas.c.albrecht@lmco.commailto:thomas.c.albrecht@lmco.com> wrote: All,
While we’re on the topic of source policies, I’ve been trying to track down the reasoning for the 15 character minimum. I’m sure it’s not conjured from nowhere, but the only policy I’ve found that dictates minimum password length [IA-5(1)] is CNSSI-1253 (Dated Mar 2014) that says 12 characters minimum.
“A case sensitive 12-character mix of upper case letters, lower case letters, numbers and special characters in including at least one of each.”
I checked the classified and intelligence overlays, and didn’t see any reference to the control. So, can anyone point me to a policy that leads to 15 characters being in the STIG?
Tom A.
Thomas Albrecht III, CISSP-ISSEP, RHCSA Cyber Architect | Cyber Insidehttps://insidelm.external.lmco.com/cyber-inside |CAS2T Lockheed Martin, Rotary and Mission Systems (RMS) 230 Mall Blvd, | King of Prussia, PA [m] 610-906-4356 cyber.security@lmco.commailto:cyber.security@lmco.com [cid:image003.png@01D030AD.9DBE6340]
_______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.orgmailto:scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.orgmailto:scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor...
Not sure if this is relevant:
https://support.microsoft.com/en-ca/help/299656/how-to-prevent-windows-from-...
From: davey.p.vargas@hotmail.com Sent: January 11, 2019 3:36 PM To: scap-security-guide@lists.fedorahosted.org Reply to: scap-security-guide@lists.fedorahosted.org Cc: shawn@redhat.com Subject: Re: Minimum Password Length (15 vs 12)
I haven't checked just yet, but I believe the password length information is within the OF A 500-27 and possibly within the CNSSI 1253 Appendix J (depending on customer requirements.
Get Outlook for Androidhttps://aka.ms/ghei36
________________________________ From: Jerome Athias athiasjerome@gmail.com Sent: Friday, January 11, 2019 2:27:20 PM To: SCAP Security Guide Cc: Shawn Wells Subject: Re: Minimum Password Length (15 vs 12)
SP 800-53 IA-5 (1)(a) globalized to 14+ due to the LM hash factor?
On Fri 11 Jan 2019 at 03:12, Albrecht, Thomas C <thomas.c.albrecht@lmco.commailto:thomas.c.albrecht@lmco.com> wrote: All,
While we’re on the topic of source policies, I’ve been trying to track down the reasoning for the 15 character minimum. I’m sure it’s not conjured from nowhere, but the only policy I’ve found that dictates minimum password length [IA-5(1)] is CNSSI-1253 (Dated Mar 2014) that says 12 characters minimum.
“A case sensitive 12-character mix of upper case letters, lower case letters, numbers and special characters in including at least one of each.”
I checked the classified and intelligence overlays, and didn’t see any reference to the control. So, can anyone point me to a policy that leads to 15 characters being in the STIG?
Tom A.
Thomas Albrecht III, CISSP-ISSEP, RHCSA Cyber Architect | Cyber Insidehttps://insidelm.external.lmco.com/cyber-inside |CAS2T Lockheed Martin, Rotary and Mission Systems (RMS) 230 Mall Blvd, | King of Prussia, PA [m] 610-906-4356 cyber.security@lmco.commailto:cyber.security@lmco.com [cid:image003.png@01D030AD.9DBE6340]
_______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.orgmailto:scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.orgmailto:scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor... THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.
scap-security-guide@lists.fedorahosted.org
-
Albrecht, Thomas C -
Brent Kimberley -
Davey Vargas -
Jerome Athias -
Todd, Charles