IA.L2-3.5.10Cryptographically-protected Passwords
Store and transmit only cryptographically-protected passwords.
[a]
passwords are cryptographically protected in storage; and[b]
passwords are cryptographically protected in transit.
Salted hashes at rest, no cleartext protocols on the wire, and a CI check against logging secrets
Implementation
AO coverage. Addresses both Cryptographically-protected Passwords objectives — storage and transit — for the directories, applications, and network devices in scope.
Storage. The directory stores salted hashes with reversible encryption disabled. In-house applications hash with Argon2id, and the cost parameters are recorded in the application baseline so a reviewer can see they were chosen rather than defaulted. No table, report, or export contains a password column. Automation secrets live in the vault, not in application configuration files or pipeline variables.
Transit. Every authentication endpoint requires TLS 1.2 or higher; internal apps redirect to HTTPS and send HSTS. LDAP simple binds are disabled in favor of LDAPS/StartTLS with channel binding required. LM and NTLMv1 are disabled by policy, and the remaining NTLMv2 usage is scoped to one file service and monitored. SNMPv2 community strings on enclave gear were replaced with SNMPv3 authPriv.
Development standard. Credentials must never be written to logs. A CI check fails the build on the known bad patterns (logging a request body on the auth route, printing a bind DN password, echoing environment secrets), which caught two real regressions before release.
Maintenance. Quarterly scan of enclave VLANs for cleartext authentication protocols (telnet, FTP, HTTP logon forms, unencrypted LDAP binds), with findings ticketed. Annual review of hashing parameters against current guidance and current hardware.
Accepted gap. One MES module posts credentials to a servlet that only supports basic authentication. It is reachable only inside the enclave VLAN and only through a TLS-terminating reverse proxy, so nothing crosses the wire in the clear; the vendor's native fix has a tracked review date.
What the evidence looks like
- Directory settings showing reversible encryption disabled and simple binds refused
- Application baseline documenting the Argon2id parameters
- NTLM restriction and SNMPv3 configuration exports
- CI check definition plus the two blocked-build records
- Quarterly cleartext-protocol scan output and the reverse-proxy configuration for the MES module
Environment
Tools
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.