CWE

普遍的弱点

社区开发的软件和硬件弱点类型清单

2021 CWE Most Important Hardware Weaknesses
CWE Top 25 Most Dangerous Weaknesses
Home>CWE List> CWE-单个字典定义(4.9)
ID

CWE-262: Not Using Password Aging

弱点ID:262
Abstraction:Base
Structure:Simple
查看自定义信息:
+描述
该产品没有用于管理密码衰老的机制。
+扩展描述

密码老化(或密码旋转)是一项策略,迫使用户在定义的时间段通过后(例如每30或90天)更改密码。如果没有衰老等机制,用户可能不会及时更改密码。

请注意,虽然密码老化曾经被认为是一项重要的安全功能,但此后,它已被许多人失望,因为与诸如慢速哈希之类的其他机制相比,它对现代威胁不那么有效。此外,强迫频繁的更改可以无意间鼓励用户选择不太安全的密码。但是,由于符合性要求(例如支付卡行业数据安全标准(PCI DSS))等因素,密码衰老仍在使用。

+Relationships
Section HelpThis table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
+与观点“研究概念”相关(CWE-1000)
Nature 类型 ID Name
ChildOf Class班级 - 以非常抽象的方式描述的弱点,通常与任何特定的语言或技术无关。比支柱弱点更具体,但比基本弱点更一般。班级弱点通常用以下维度的1或2来描述问题:行为,属性和资源。 1390 Weak Authentication
PeerOf Base基础 - 仍然主要独立于资源或技术的弱点,但有足够的细节来提供特定的检测和预防方法。基本水平的弱点通常用以下维度的2或3来描述问题:行为,财产,技术,语言和资源。 309 使用密码系统进行主要身份验证
PeerOf Base基础 - 仍然主要独立于资源或技术的弱点,但有足够的细节来提供特定的检测和预防方法。基本水平的弱点通常用以下维度的2或3来描述问题:行为,财产,技术,语言和资源。 324 使用钥匙过期的日期
Section HelpThis table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
+与“软件开发”视图相关(CWE-699)
Nature 类型 ID Name
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 255 Credentials Management Errors
Section HelpThis table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
+与“建筑概念”(CWE-1008)有关
Nature 类型 ID Name
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 1010 认证演员
+Modes Of Introduction
Section HelpThe different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
阶段 Note
建筑和设计 委员会:这种弱点是指与建筑安全策略相关的不正确设计。
+Applicable Platforms
Section HelpThis listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

Class: Not Language-Specific(Undetermined Prevalence)

+Common Consequences
Section HelpThis table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
Scope 影响 Likelihood
访问控制

Technical Impact:Gain Privileges or Assume Identity

As passwords age, the probability that they are compromised grows.
+Likelihood Of Exploit
低的
+示例的例子

示例1

系统不会在某个某个时期执行更改密码的更改。

+潜在的缓解

阶段: Architecture and Design

作为产品设计的一部分,要求用户定期更改密码,并避免重复使用以前的密码。

阶段:实施

开发人员可能会将剪贴板粘贴操作禁用到密码字段中,以阻止用户将密码粘贴到剪贴板中。但是,这可能会鼓励用户选择更易于键入的安全密码,并且可以降低密码管理器的可用性[REF-1294]。

有效性:劝阻普通实践

+会员资格
Section HelpThis MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
Nature 类型 ID Name
成员 ViewView - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). 884 CWE横截面
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 951 SFP Secondary Cluster: Insecure Authentication Policy
+分类映射
Mapped Taxonomy Name Node ID 合身 Mapped Node Name
CLASP 不允许密码老化
+参考
[Ref-18] Secure Software,Inc.。“ The CLASP应用程序安全过程”。2005年。<https://cwe.mitre.org/documents/sources/theclaspapplicationsecurityprocess.pdf>。
[Ref-44] Michael Howard,David Leblanc和John Viega。“软件安全性的24个致命罪”。“ SIN 19:使用基于密码的弱系统。”第279页。McGraw-Hill。2010年。
[REF-1305] Kurt Seifried and other members of the CWE-Research mailing list. "Discussion Thread: Time to retire CWE-262 and CWE-263". 2022-10-11. 2021-12-03. <https://www.mail-archive.com/cwe-research-list@mitre.org/msg00018.html>。
[Ref-1289] Lance Spitzner。“密码到期的时间”。2021-06-27。<https://www.sans.org/blog/time-for-password-expiration-to-die/>。
[Ref-1290] Lorrie Cranor。“重新考虑强制性密码更改的时间”。2016-03-02。<>。
[Ref-1291] Eugene Spafford。“安全神话和密码”。2006-04-19。<https://www.cerias.purdue.edu/site/blog/post/password-change-myths/>。
[Ref-1292]国家网络安全中心。“系统所有者的密码管理”。2018-11-19。<https://www.ncsc.gov.uk/collection/passwords/updating-your-approach>。
[Ref-1293] NIST。“数字身份指南:身份验证和生命周期管理(SP 800-63B)”。2017-06。<https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf>。
[Ref-1294]国家网络安全中心。“让他们粘贴密码”。2017-01-02。<https://www.ncsc.gov.uk/blog-post/let-them-paste-passwords>。
+Content History
+提交
提交日期 Submitter 组织
2006-07-19 CLASP
+Contributions
贡献日期 Contributor 组织
2021-12-03 Kurt Seifried, Chris Eng, G. Ann Campbell, Larry Shields, Jeffrey Walton, Jason Dryhurst-Smith, and other members of the CWE Community
Gave feedback on how to updateCWE-262CWE-263由于密码管理实践的改变
+Modifications
Modification Date 修饰符 组织
2008-09-08 CWE Content Team MITRE
更新的common_cconsquences, Relationships, Other_Notes, Taxonomy_Mappings
2011-03-29 CWE Content Team MITRE
更新的关系
2011-06-01 CWE Content Team MITRE
更新的common_cconsquences
2011-06-27 CWE Content Team MITRE
更新的common_cconsquences
2012-05-11 CWE Content Team MITRE
更新的引用,关系
2014-06-23 CWE Content Team MITRE
更新了其他_notes,势_mitigations
2014-07-30 CWE Content Team MITRE
更新的关系
2017-11-08 CWE Content Team MITRE
updated Applicable_Platforms, Likelihood_of_Exploit, Modes_of_Introduction, Relationships
2020-02-24 CWE Content Team MITRE
updated Demonstrative_Examples, Description, Potential_Mitigations, References, Type
2020-08-20 CWE Content Team MITRE
updated Related_Attack_Patterns
2022-10-13 CWE Content Team MITRE
更新的描述,潜在_METIGITIONS,参考,关系
+先前的输入名称
改变日期 Previous Entry Name
2008-04-11 不允许密码老化
提供更多信息 - 请选择其他过滤器。
Page Last Updated:2022年10月13日