Password Security Review Checklist

Description

To assess an application, there is a need to input a username and a password to authenticate the user. Password is typically a string of characters, usually used to confirm the identity of a user. According to the NIST Digital Identity Guidelines, password is the secret memorized by a party called the claimant while the party verifying the identity of the claimant is called the verifier. When the claimant successfully demonstrates knowledge of the password to the verifier through an established authentication protocol, the verifier is able to infer the claimant’s identity. This Checklist will enable assurance professionals to identify risk areas and provide value-adding recommendations to fix observed gaps in good time