MITRE D3FENDdefensive technique

D3-SPP Strong Password Policy

Official page ↗

Tactic: Harden

Definition

Modifying system configuration to increase password strength.

How it works

How it works Password strength guidelines include increasing password length, permitting passwords that contain ASCII or Unicode characters, and requiring systems to screen new passwords against lists of commonly used or compromised passwords. Considerations Extremely complex password requirements may lead users to saving passwords in text files or picking obvious passwords that meet the policy.

Counters · MITRE ATT&CK (4)

T1110.001 Password Guessing sub-technique
T1110.002 Password Cracking sub-technique
T1110.003 Password Spraying sub-technique
T1110 Brute Force technique

Child of · MITRE D3FEND (1)

D3-CH Credential Hardening defensive technique

Referenced by MITRE D3FEND · child of (1)

D3-CDP Change Default Password defensive technique

References

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf Digital Identity Guidelines
https://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords