Topic

Single-factor authentication

Applicable to

all

History

Priority

should

Sep 2024

Passphrases used for single-factor authentication are at least 4 random words with a total minimum length of 15 characters, unless more stringent requirements apply.

The existing control relating to passphrase length for single-factor authentication being a minimum length of 14 characters was amended to a minimum length of 15 characters.

Dec 2021

Passphrases used for single-factor authentication are at least 4 random words with a total minimum length of 14 characters, unless more stringent requirements apply.

Miscellaneous changes were made to rationale and security controls throughout the publication. This included:

• A review from the Using the Information Security Manual chapter through to the Guidelines for Media chapter.

• Security controls suitable for all audiences have been identified with the ‘All’ applicability marking while additional security controls suitable for just government audiences have been identified with the O, P, S and TS applicability markings.

• Security controls suitable for specific classifications have been amended to include their classification(s) in the wording of the security controls to reduce the reliance on applicability markings to confer suitability.

• Tables in security controls have been converted into prose to allow for inclusion in the SSP annex template and the XML list of security controls.

• The use of ‘official’ and ‘highly classified’ terminology has been replaced with specific classifications to remove ambiguity.

• Security controls relating to high assurance ICT equipment have had their applicability narrowed to ‘S, TS’ reflecting that they are intended for the protection of SECRET and TOP SECRET systems and data.

Oct 2019

Passphrases used for single-factor authentication are a minimum of 14 characters with complexity, ideally as 4 random words.

Following a rigorous review of the ability of passphrases used for single-factor authentication to withstand attack, security controls 0421 and 0422 were modified, 1426 was removed, and security controls 1557 and 1558 were added.

Sep 2019

Passphrases used as the sole method of authentication enforce a minimum of 13 alphabetic characters; or a minimum of 10 characters consisting of at least three of the following character sets: § lowercase alphabetic characters (a-z) § uppercase alphabetic characters (A-Z) § numeric characters (0-9) § special characters.

2017

Agencies using passphrases as the sole method of authentication must enforce the followingpassphrase policy:• a minimum length of 13 alphabetic characters with no complexity requirement; or• a minimum length of 10 characters, consisting of at least three of the followingcharacter sets:• lowercase alphabetic characters (a–z)• uppercase alphabetic characters (A–Z)• numeric characters (0–9)• special characters.

Control Text Changed. No public explaination.

2015

Agencies using passphrases as the sole method of authentication must enforce the followingpassphrase policy:• a minimum length of 13 alphabetic characters with no complexity requirement; or• a minimum length of 10 characters, consisting of at least three of the followingcharacter sets:– lowercase alphabetic characters (a–z)– uppercase alphabetic characters (A–Z)– numeric characters (0–9)– special characters.

2010

Agencies should implement a password policy enforcing either:• a minimum password length of 12 characters with no complexity requirement; or• a minimum password length of seven characters, consisting of at least three of the following character sets:– lowercase characters (a-z)– uppercase characters (A-Z)– digits (0-9)– punctuation and special characters.

2008

Agencies should implement a password policy enforcing either: a. a minimum password length of 12 characters with no complexity requirement or b. a minimum password length of seven characters, consisting of at least three of the following character sets: 1) lowercase characters (a¡z) 2) uppercase characters (A¡Z) 3) digits (0¡9) 4) punctuation and special characters.