Regulations that specify password length?

Question

I have read:

• PCI DSS 1.2
• SOX 404
• AR 25-2
• ISO 27001

But only PCI DSS specifies a minimum password length.

Are there any other regulations that dictate password lengths for any industry?

NIST documents talk about the impacts of certain lengths and complexities. OWASP, SANS, and others give their opinions on password minimums, but they couldn't be considered official.

Not looking for recommendations or impacts of various lengths, but actual regulations that require a certain length. For the purposes of this question, it doesn't even matter if the regulations are good or not, just some regulatory body saying that passwords must be at least a certain length.

Answer 1

I believe the National Institute of Standards and Technology (NIST) publishes the United States Government Configuration Baseline (USGCB, formerly known as Federal Desktop Core Configuration or FDCC) checklists, which specify the password complexity, lifetime, and history requirements for U.S. federal organizations. Also, the Center for Internet Security (CIS) publishes Benchmarks for various platforms, which include similar recommendations.

Between the two, the highest mark is:

• 12 characters minimum.
• At least three character types.
• Expiration in 60 days.
• Minimum lifetime of 1 day.
• No reuse within 24 passwords.
• Some OS-specific additional requirements may be applied.

Those settings are applied at the OS level. I'm not sure if either organization has similar specifications specifically targeting applications or websites, but most organizations which are subject to these will probably just use the same requirements as they do in the OS.

A Google search for any of the above terms should turn up a wealth of information. (I may add links here myself later, or anyone else is free to edit them in.)

Answer 2

To be honest the "official documentation" for all of these standards is incomplete, and as a CISSP in the industry its really annoying.

How I look at it is that no one is going to approve you if you have known vulnerabilities in your software, period. The authority for this is the is the Community Emergency Response Teams (CERT), and CERTs issue CVE numbers for vulnerabilities. All CERTs use the Common Weakness Enumeration system to classify vulnerabilities in software.

There is CWE-521 - Weak Password Requirements which lists the following:

1. Minimum and maximum length;
2. Require mixed character sets (alpha, numeric, special, mixed case);
3. Do not contain user name;
4. Expiration;
5. No password reuse.

It should be noted that the CWE system is a tree, and the parent of CWE-521 is CWE-255 credentials management.

Answer 3

Since you are looking for ANY regulatory body, whether applicable to you or not, Department of Defense Instruction 8500.2, Information Assurance Implementation states:

For systems utilizing a logon ID as the individual identifier, passwords are, at a minimum, a case sensitive, 8-character mix of upper case letters, lower case letters, numbers, and special characters, including at least one of each (e.g., emPagd2!). At least four characters must be changed when a new password is created.