The DISA Application Developer STIG specifies:
Group ID (Vulid): V-69565
Rule ID: SV-84187r1_rule
Rule Version (STIG-ID): APSC-DV-001730
Rule Title: The application must require the change of at least 8 of the total number of characters when passwords are changed.
The Check Content isn't any less vague:
When prompted to provide the password, attempt to change less than 8 characters of the total number of characters in the password.
If less than 8 characters of the password are changed, this is a finding.
My team and I are having a hard time determining the official interpretation of this rule. Does index count? Does adding 8 new characters onto your original password count as changing 8?
We ended up determining the difference using the Levenshtein Distance algrorithm, but fear that our success may be determined by the subjective interpretation of someone else who might perform IA tests/scans on our application in the future.
Is there some "official" technical definition of a "change of at least 8 characters"?