risk
Weak authentication and password management
Absent password policy, no MFA, credentials transmitted in clear text, and no session lock/logout on unattended workstations, making account compromise, brute-force login, and session hijacking easy.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Access Control & Identity Management
- Network & Communications Security
- taxonomy
- iso-27005-vulnerability
- nist-800-30-threat-event
- inherent_rating
- high
Details
- risk_id
- access-weak-authentication
- category
- cyber_security
- likelihood
- high
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
- nist-800-30-threat-event
Source
No record-specific source URL is provided.
Connections
- UC-NET-03 — Provide trusted channels and control session lifecycle mitigates Weak authentication and password management
- strength
- related
- rationale
- Terminating connections after inactivity addresses unattended-session/no-logout exposure; primary auth strength owned elsewhere.
- UC-NET-02 — Authorize and secure remote, wireless, and mobile access mitigates Weak authentication and password management
- strength
- related
- rationale
- Requiring mutual authentication before a remote connection is permitted reduces account compromise on those channels; MFA/password policy owned elsewhere.
- UC-ACCESS-10 — Authenticate devices and services before granting connections mitigates Weak authentication and password management
- strength
- related
- rationale
- Cryptographic non-person credentials with no shared static secrets extend strong authentication to services and devices.
- UC-ACCESS-09 — Authenticate all users with multi-factor authentication mitigates Weak authentication and password management
- strength
- primary
- rationale
- MFA with credential validation only over protected channels directly remediates absent MFA and clear-text authentication.
- UC-ACCESS-08 — Manage and protect authenticators across their lifecycle mitigates Weak authentication and password management
- strength
- primary
- rationale
- Enforced minimum strength, changed vendor defaults, salted-hash/encrypted storage, and protected transmission directly fix weak-password and clear-text credential exposure.
- UC-ACCESS-11 — Defend logons against brute-force and anomalous attempts mitigates Weak authentication and password management
- strength
- primary
- rationale
- Account lockout and throttling after consecutive failed attempts directly defeat brute-force login.
- UC-ACCESS-12 — Lock, limit, and terminate user sessions mitigates Weak authentication and password management
- strength
- primary
- rationale
- Inactivity session lock requiring re-authentication directly fixes the missing lock/logout on unattended workstations.