← Back to Application Security and Development Security Technical Implementation Guide

V-222662

CAT I (High)

Default passwords must be changed.

Rule ID

SV-222662r961863_rule

STIG

Application Security and Development Security Technical Implementation Guide

Version

V6R4

CCIs

CCI-003109

Discussion

Default passwords can easily be compromised by attackers allowing immediate access to the applications.

Check Content

Identify the application name and version and do an Internet search for the product name and the string "default password".

If default passwords are found, attempt to authenticate with the published default passwords.

If authentication is successful, this is a finding.

Fix Text

Configure the application to use strong authenticators instead of passwords when possible. Otherwise, change default passwords to a DoD-approved strength password and follow all guidance for passwords.