#iso27002/2022/EN
## 5.17 Authentication information

### Control
Allocation and management of authentication information should be controlled by a management process, including advising personnel on the appropriate handling of authentication information.

### Purpose
To ensure proper entity authentication and prevent failures of authentication processes.

### Guidance

**Allocation of authentication information**

The allocation and management process should ensure that:

a)   personal passwords or personal identification numbers (PINs) generated automatically during enrolment processes as temporary secret authentication information are non-guessable and unique for each person, and that users are required to change them after the first use;

b)   procedures are established to verify the identity of a user prior to providing new, replacement or temporary authentication information;

c)   authentication  information,  including  temporary  authentication  information,  is  transmitted to users in a secure manner (e.g. over an authenticated and protected channel) and the use of unprotected (clear text) electronic mail messages for this purpose is avoided;

d)   users acknowledge receipt of authentication information;

e)   default authentication information as predefined or provided by vendors is changed immediately following installation of systems or software;

f)   records of significant events concerning allocation and management of authentication information are kept and their confidentiality is granted, and that the record-keeping method is approved (e.g. by using an approved password vault tool).

**User responsibilities**

Any person having access to or using authentication information should be advised to ensure that:

a)   secret  authentication  information  such  as  passwords  are  kept  confidential.  Personal  secret authentication information is not to be shared with anyone. Secret authentication information used in the context of identities linked to multiple users or linked to non-personal entities are solely shared with authorized persons;

b)   affected or compromised authentication information is changed immediately upon notification of or any other indication of a compromise;

c)   when passwords are used as authentication information, strong passwords according to best practice recommendations are selected, for example:
1)   passwords are not based on anything somebody else can easily guess or obtain using personrelated information (e.g. names, telephone numbers and dates of birth);
2)   passwords are not based on dictionary words or combinations thereof;
3)   use easy to remember passphrases and try to include alphanumerical and special characters;
4)   passwords have a minimum length;

d)   the same passwords are not used across distinct services and systems;

e)   the obligation to follow these rules is also included in terms and conditions of employment (see [6.2](a-6.2-Terms-and-conditions-of-employment.md)).

**Password management system**

When passwords are used as authentication information, the password management system should:

a)   allow users to select and change their own passwords and include a confirmation procedure to address input errors;

b)   enforce  strong  passwords  according  to  good  practice  recommendations \[see  c)  of  "User responsibilities"\];

c)   force users to change their passwords at first login;

d)   enforce password changes as necessary, for example after a security incident, or upon termination or change of employment when a user has known passwords for identities that remain active (e.g. shared identities);

e)   prevent re-use of previous passwords;

f)   prevent  the  use  of  commonly-used  passwords  and  compromised  usernames,  password combinations from hacked systems;

g)   not display passwords on the screen when being entered;

h)   store and transmit passwords in protected form.

Password  encryption  and  hashing  should  be  performed  according  to  approved  cryptographic techniques for passwords (see [8.24](a-8.24-Use-of-cryptography.md)).

**Other information**

Passwords or passphrases are a commonly used type of authentication information and are a common means of verifying a user’s identity. Other types of authentication information are cryptographic keys, data stored on hardware tokens (e.g. smart cards) that produce authentication codes and biometric data such as iris scans or fingerprints. Additional information can be found in the ISO/IEC 24760 series.

Requiring frequent change of passwords can be problematic because users can get annoyed by the frequent changes, forget new passwords, note them down in unsafe places, or choose unsafe passwords. Provision of single sign on (SSO) or other authentication management tools (e.g. password vaults) reduces the amount of authentication information that users are required to protect and can thereby increase the effectiveness of this control. However, these tools can also increase the impact of disclosure of authentication information.

Some applications require user passwords to be assigned by an independent authority. In such cases, a), c) and d) of "Password management system" do not apply.
