V2: Authentication Verification Requirements Control objective Authentication is the act of establishing, or confirming, something (or someone) as authentic, that is, that claims made by or about the thing are true. Ensure that a verified application satisfies the following high level requirements: Verifies the digital identity of the sender of a communication. Ensures that only those authorised are able to authenticate and credentials are transported in a secure manner. Requirements # Description 1 2 3 Since Verify all pages and resources by default require 2.1 authentication except those specifically intended to be 1.0 public (Principle of complete mediation). Verify that containing credentials are not filled in by the application. Pre-filling by the application implies that 2.2 3.0.1 credentials are stored in plaintext or a reversible format, which is explicitly prohibited. Verify all authentication controls are enforced on the 2.4 1.0 server side. Verify all authentication controls fail securely to ensure 2.6 1.0 attackers cannot log in. Verify password entry fields allow, or encourage, the use of passphrases, and do not prevent password managers, 2.7 3.0.1 long passphrases or highly complex passwords being entered. Verify all account identity authentication functions (such as update profile, forgot password, disabled / lost token, 2.8 help desk or IVR) that might regain access to the account 2.0 are at least as resistant to attack as the primary authentication mechanism. Verify that the changing password functionality includes 2.9 the old password, the new password, and a password 1.0 confirmation.
V2: Authentication Verification Requirements Control objective Authentication is the act of establishing, or confirming, something (or someone) as authentic, that is, that claims made by or about the thing are true. Ensure that a verified application satisfies the following high level requirements: Verifies the digital identity of the sender of a communication. Ensures that only those authorised are able to authenticate and credentials are transported in a secure manner. Requirements # Description 1 2 3 Since 2.1 Verify all pages and resources by default require authentication except those specifically intended to be public (Principle of complete mediation). 1.0 2.2 Verify that containing credentials are not filled in by the application. Pre-filling by the application implies that credentials are stored in plaintext or a reversible format, which is explicitly prohibited. 3.0.1 2.4 Verify all authentication controls are enforced on the server side. 1.0 2.6 Verify all authentication controls fail securely to ensure attackers cannot log in. 1.0 2.7 Verify password entry fields allow, or encourage, the use of passphrases, and do not prevent password managers, long passphrases or highly complex passwords being entered. 3.0.1 2.8 Verify all account identity authentication functions (such as update profile, forgot password, disabled / lost token, help desk or IVR) that might regain access to the account are at least as resistant to attack as the primary authentication mechanism. 2.0 2.9 Verify that the changing password functionality includes the old password, the new password, and a password confirmation. 1.0