Category:WASS User Managment - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textmoncnaa.com

2009-05-27T18:31:11Z

Reverting to last version not containing links to www.textmoncnaa.com

Deleted user at 20:08, 22 May 2009

2009-05-22T20:08:32Z

MikeAndrews at 04:20, 19 May 2006

2006-05-19T04:20:38Z

New page

== Deploy mechanisms to securely perform tasks related to user management. ==

From time-to-time, application users will need to change their password or reset a forgotten password. As noted in other requirements, login credentials are often the only access control mechanism a web application provides. Therefore the application should provide secure means to perform password resets and allowing a user reset a forgotten password.

#Change password
##Immediately before changing a password, users must be required to enter their old (existing) password
##New password must meet the existing requirments of this standard.
#The password change should be performed over a secure connection
#Forgotten passwords
##Implement a “secret” question(s)/answer(s) system to manage forgotten passwords if business requirements permit.
###Old passwords should never be retrievable.
###When specifying their "secret" question, the user should have a choice of what question they are asked, and/or the question should not have a “predefined” or “limited” choice, such as “what is your favorite color” or “what was your first car”
###After a number of incorrect login attempts at answering the secret question(s) the account should be locked as it would for an incorrect username/password attempt.
###Require the user to change their password should occur immediately after correctly answering the secret question(s)
###A notification of password change or forgotten password request should be sent to the user (via email or other communication channels such as SMS).
#Passwords should never be emailed or displayed.
#All forms that gather user credentials should have auto-complete turned off and must not be pre-populated with data.

@@ Line 1: / Line 1: @@
 == Deploy mechanisms to securely perform tasks related to user management. ==
@@ Line 9: / Line 8: @@
 #The password change should be performed over a secure connection
 #Forgotten passwords
-##Implement a âsecretâ question(s)/answer(s) system to manage forgotten passwords if business requirements permit.
+##Implement a “secret” question(s)/answer(s) system to manage forgotten passwords if business requirements permit.
 ###Old passwords should never be retrievable.
-###When specifying their "secret" question, the user should have a choice of what question they are asked, and/or the question should not have a âpredefinedâ or âlimitedâ choice, such as âwhat is your favorite colorâ or âwhat was your first carâ
+###When specifying their "secret" question, the user should have a choice of what question they are asked, and/or the question should not have a “predefined” or “limited” choice, such as “what is your favorite color” or “what was your first car”
 ###After a number of incorrect login attempts at answering the secret question(s) the account should be locked as it would for an incorrect username/password attempt.
 ###Require the user to change their password should occur immediately after correctly answering the secret question(s)