Password quality, automated
An automated review gives a repeatable test of password strength.
What the published 2016 guidance says
An automated review gives a repeatable test of password strength. The construct runs a password cracker against employee account records with a defined hybrid attack, counts the passwords that resist for a defined time, and reports the share as a trend. Illustrative bands match the manual test: above 0.9 no action, 0.8 to 0.9 with a positive trend, below 0.8 immediate action. Evidence is the query on the account records and the cracker output. It is collected weekly, reviewed yearly and applied for three years. The system administrator owns it, security staff collect, and the security manager is the client.
What it means in practice
Automated cracking gives a repeatable test of password strength. Run it with a defined attack and a defined time limit, on a defined population, and keep the method stable. Changing the cracking rig breaks the trend, so record the method with the result.
Status of this record. For B.17, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Define the cracking method and the time limit. Run it on a defined population. Record the count and the method. Compare with the previous run. Treat a change of method as a break in the series.
Evidence an assessor asks for
- Access controlAuthorisation and procedure for the cracking run
- AuthenticationWeekly crackability ratio and trend
- Access controlHandling rules for the cracked results
The question an assessor will ask
An assessor will ask for authorisation and procedure for the cracking run. The test for B.17 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Cracking runs performed without authorisation or safe handling of results
- Crack window set to something other than the defined four hours, breaking comparability
Before the next review
Before the next review, test this against one live record: cracking runs performed without authorisation or safe handling of results.
What to check when the revision publishes
When DIS 27004 is published, compare the B.17 Password quality, automated record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.