search

cisagov / ScubaGoggles

SCuBA Secure Configuration Baselines and assessment tool for Google Workspace
https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
Creative Commons Zero v1.0 Universal
149 stars 20 forks source link

New NIST Password Guidelines + Changing Password Length Policy #442

Open mdueltgen opened 19 hours ago

mdueltgen commented 19 hours ago

https://cybersecuritynews.com/nist-rules-password-security/ https://pages.nist.gov/800-63-3/sp800-63b.html

New NIST Guidelines change password recommended length to 15 so GWS.COMMONCONTROLS.5.2v0.3 should be updated from the current length of 12

adhilto commented 18 hours ago

NIST's guidance is: "Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length." We might want to also adopt as split SHALL/SHOULD approach here as well rather than just upping the SHALL minimum to 15.