Verify that all authentication decisions can be logged, without storing sensitive session identifiers or passwords. 2.12 3.0.1 This should include requests with relevant metadata needed for security investigations. Verify that account passwords are one way hashed with a 2.13 salt, and there is sufficient work factor to defeat brute 3.0.1 force and password hash recovery attacks. Verify that credentials are transported using a suitable encrypted link and that all pages/functions that require a 2.16 3.0 user to enter credentials are done so using an encrypted link. Verify that the forgotten password function and other 2.17 recovery paths do not reveal the current password and 2.0 that the new password is not sent in clear text to the user. Verify that information enumeration is not possible via 2.18 2.0 login, password reset, or forgot account functionality. Verify there are no default passwords in use for the 2.19 application framework or any components used by the 2.0 application (such as “admin/password”). Verify that anti-automation is in place to prevent breached 2.20 credential testing, brute forcing, and account lockout 3.0.1 attacks. Verify that all authentication credentials for accessing 2.21 services external to the application are encrypted and 2.0 stored in a protected location. Verify that forgotten password and other recovery paths use a TOTP or other soft token, mobile push, or other 2.22 3.0.1 offline recovery mechanism. Use of a random value in an e-mail or SMS should be a last resort and is known weak. Verify that account lockout is divided into soft and hard lock status, and these are not mutually exclusive. If an 2.23 3.0 account is temporarily soft locked out due to a brute force attack, this should not reset the hard lock status. Verify that if shared knowledge based questions (also known as "secret questions") are required, the questions 2.24 3.0.1 do not violate privacy laws and are sufficiently strong to protect accounts from malicious recovery. Verify that the system can be configured to disallow the 2.25 2.0 use of a configurable number of previous passwords.
2.12 Verify that all authentication decisions can be logged, without storing sensitive session identifiers or passwords. This should include requests with relevant metadata needed for security investigations. 3.0.1 2.13 Verify that account passwords are one way hashed with a salt, and there is sufficient work factor to defeat brute force and password hash recovery attacks. 3.0.1 2.16 Verify that credentials are transported using a suitable encrypted link and that all pages/functions that require a user to enter credentials are done so using an encrypted link. 3.0 2.17 Verify that the forgotten password function and other recovery paths do not reveal the current password and that the new password is not sent in clear text to the user. 2.0 2.18 Verify that information enumeration is not possible via login, password reset, or forgot account functionality. 2.0 2.19 Verify there are no default passwords in use for the application framework or any components used by the application (such as “admin/password”). 2.0 2.20 Verify that anti-automation is in place to prevent breached credential testing, brute forcing, and account lockout attacks. 3.0.1 2.21 Verify that all authentication credentials for accessing services external to the application are encrypted and stored in a protected location. 2.0 2.22 Verify that forgotten password and other recovery paths use a TOTP or other soft token, mobile push, or other offline recovery mechanism. Use of a random value in an e-mail or SMS should be a last resort and is known weak. 3.0.1 2.23 Verify that account lockout is divided into soft and hard lock status, and these are not mutually exclusive. If an account is temporarily soft locked out due to a brute force attack, this should not reset the hard lock status. 3.0 2.24 Verify that if shared knowledge based questions (also known as "secret questions") are required, the questions do not violate privacy laws and are sufficiently strong to protect accounts from malicious recovery. 3.0.1 2.25 Verify that the system can be configured to disallow the use of a configurable number of previous passwords. 2.0
OWASP_Application_Security_Verification_Standard_3.0.1.docx