CWE-262: Not Using Password Aging
查看自定义信息:
密码老化(或密码旋转)是一项策略,迫使用户在定义的时间段通过后(例如每30或90天)更改密码。如果没有衰老等机制,用户可能不会及时更改密码。 请注意,虽然密码老化曾经被认为是一项重要的安全功能,但此后,它已被许多人失望,因为与诸如慢速哈希之类的其他机制相比,它对现代威胁不那么有效。此外,强迫频繁的更改可以无意间鼓励用户选择不太安全的密码。但是,由于符合性要求(例如支付卡行业数据安全标准(PCI DSS))等因素,密码衰老仍在使用。
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
与观点“研究概念”相关(CWE-1000)
与“软件开发”视图相关(CWE-699)
与“建筑概念”(CWE-1008)有关
The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
This listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
Languages Class: Not Language-Specific(Undetermined Prevalence)
This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
提供更多信息 - 请选择其他过滤器。
|
使用共同弱点枚举(CWE)和本网站的相关参考Terms of Use。CWE由美国国土安全部(DHS)Cybersecurity and Infrastructure Security Agency(CISA) and managed by theHomeland Security Systems Engineering and Development Institute(HSSEDI)由manbetx客户端首页(MITER)。版权所有©2006–2023,Miter Comanbetx客户端首页rporation。CWE,CWSS,CWRAF和CWE徽标是Miter Corporation的商标。manbetx客户端首页 |