Industry:Draft NIST SP 800-118 - Revision history

Clerkendweller: Final version added as PDF link / status changed to closed

2009-05-29T13:46:24Z

Final version added as PDF link / status changed to closed

Clerkendweller: EK not OK

2009-05-28T14:11:37Z

EK not OK

Clerkendweller: /* Draft Text version 2 */ Page tidy-up

2009-05-28T08:09:57Z

‎Draft Text version 2: Page tidy-up

Clerkendweller: /* Comments */ ditto

2009-05-28T08:09:03Z

‎Comments: ditto

Clerkendweller: /* Summary */ Further mods to draft 3

2009-05-28T08:08:40Z

‎Summary: Further mods to draft 3

Clerkendweller: version is table updated to 3rd draft

2009-05-26T19:03:45Z

version is table updated to 3rd draft

Clerkendweller: /* Draft Text version 3 */ Draft 3

2009-05-26T19:02:36Z

‎Draft Text version 3: Draft 3

Clerkendweller at 14:34, 22 May 2009

2009-05-22T14:34:36Z

Clerkendweller: Draft 2

2009-05-22T14:27:02Z

Draft 2

Clerkendweller at 12:55, 19 May 2009

2009-05-19T12:55:53Z

@@ Line 42: / Line 42: @@
   | style="width:25%; background:#7B8ABD" align="center"| '''Status'''
   | colspan="3" style="width:75%; background:#cccccc" align="left"|
-* 3rd Draft
+* Closed
   |-
   | style="width:25%; background:#7B8ABD" align="center"| '''Resources'''
@@ Line 60: / Line 60: @@
 === Final version ===
-''TBC''
+Submitted as a PDF [[Image:Owasp-nist-sp800-118-response.pdf]]
 === Draft Text version 3 ===
 ==== Summary ====

@@ Line 17: / Line 17: @@
 | style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
   | style="width:25%; background:#cccccc" align="center"|'''Primary'''<br>[mailto:colin.watson(at)owasp.org '''Colin Watson''']
-  | style="width:25%; background:#cccccc" align="center"|'''Secondary'''<br>OK, RB, DC
+  | style="width:25%; background:#cccccc" align="center"|'''Secondary'''<br>EK, RB, DC
   | style="width:25%; background:#cccccc" align="center"|'''Mailing list'''<br>Please use the [http://lists.owasp.org/mailman/listinfo/global_industry_committee Industry Committee list]
   |}

@@ Line 148: / Line 148: @@
 === Draft Text version 2 ===
 ==== Summary ====
@@ Line 221: / Line 216: @@
 * [http://www.owasp.org/index.php/OWASP_Foundation About The Open Web Application Security Project]
 * [http://www.owasp.org/ The Open Web Application Security Project]
 === Draft Text version 1 ===

@@ Line 67: / Line 67: @@
 ==== Comments ====
-''Add comments, additions, changes on draft 1 here please, or to lists or directly to CW''
+''Add comments, additions, changes on draft 3 here please, or to lists or directly to CW''
 ==== Summary ====

@@ Line 76: / Line 76: @@
 <span style="color:#f00;">Applications, and especially web applications and web services, are increasingly being targeted to spread malware and to access sensitive data.  Many web applications are available over untrusted networks or are by accessed by untrusted clients.  Passwords are almost universally used in such software.  Therefore, we believe that additional emphasis is required on aspects of enterprise password management relating to software applications.  These issues can be of a different nature to other types of password-protected information systems.</span>
-<span style="color:#f00;">We welcome the references to other documents in the footers, but believe that greater detail and/or reference to more sources of information would be a great benefit to readers of the final document.  This may be using additional footnotes or by the inclusion of a bibliography/further guidance section.  In particular we would like to suggest two of OWASP's key projects—the Development Guide and the Application Security Verification Standard (ASVS)—containing detailed information on good development and verification practices.  These contain significant guidance on the use of passwords and related authentication, authorization and session management.</span>
+<span style="color:#f00;">We welcome the references to other documents in the footers, but believe that greater detail and/or reference to more sources of information would be a great benefit to readers of the final document.  This may be using additional footnotes or by the inclusion of a bibliography/further guidance section.  In particular we would like to suggest three of OWASP's key projects—the Development Guide(1), the Testing Guide(2) and the Application Security Verification Standard (ASVS)(3)—containing detailed information on good development, testing and verification practices respectively.  These contain significant guidance on the use of passwords and related authentication, authorization and session management.</span>
 <span style="color:#f00;">For all passwords, it is vitally important that the method of generating passwords and complexity rules should be appropriate for the level of risk, and should be kept secret.  Any knowledge on complexity rules (such as minimum and maximum length, character sets, etc) or technologies used reduce the effective number of options for brute force attacks and thus make the task of cracking passwords very much less costly, especially if this is combined with non-existent or poorly implemented lockout policies.</span>
@@ Line 84: / Line 84: @@
 * <span style="color:#f00;">increase information on application-related issues</span>
 * <span style="color:#f00;">provide additional detail and references</span>
-* <span style="color:#f00;">password complexity should be kept secret, and must be related to risk</span>
+* <span style="color:#f00;">password complexity requirements must be related to risk and should be kept secret</span>
 * <strike style="color:#f00;">place greater emphasis on the many systems available over untrusted networks or by untrusted clients, such as web applications</strike>
@@ Line 91: / Line 91: @@
 <strike style="color:#f00;">The</strike> <span style="color:#f00;">Our</span> detailed point-by-point response follows.
 ==== 2 Introduction to Passwords and Password Management ====

@@ Line 42: / Line 42: @@
   | style="width:25%; background:#7B8ABD" align="center"| '''Status'''
   | colspan="3" style="width:75%; background:#cccccc" align="left"|
-* 1st Draft
+* 2nd Draft
   |-
   | style="width:25%; background:#7B8ABD" align="center"| '''Resources'''
@@ Line 59: / Line 59: @@
 === Final version ===
 ''TBC''
@@ Line 78: / Line 83: @@
 ...
-<span style="color:#f00;">Recommendations
+<span style="color:#f00;">Our main recommendations are:
 * <span style="color:#f00;">place greater emphasis on the many systems available over untrusted networks or by untrusted clients, such as web applications</span>
-* <span style="color:#f00;">web application development teams should consider the password management issues in A Guide to Building Secure Web Applications and Web Services</span>
+* <span style="color:#f00;">web application development teams should consider the password management issues in "A Guide to Building Secure Web Applications and Web Services"</span>
-* <span style="color:#f00;">the authentication requirements in the Application Security Verification Standard should (ASVS) also be used to assess enterprise password management in web applications</span>
+* <span style="color:#f00;">the authentication requirements in the "Application Security Verification Standard" (ASVS) should also be used to assess enterprise password management in web applications</span>
-<span style="color:#f00;">The detailed response follows.</span>
+<span style="color:#f00;">The detailed point-by-point response follows.</span>
 <span style="color:#f00;">==== 2 Introduction to Passwords and Password Management ====</span>
@@ Line 90: / Line 95: @@
 <span style="color:#f00;">'''Explanation''' Resources that require protection are sometimes available without authentication, or the password-based authentication mechanisms may not be implemented correctly.  Reference: Authentication Verification Requirements, Application Security Verification Standard (ASVS) Web Application Edition, 2008, OWASP http://www.owasp.org/index.php/ASVS</span>
-<span style="color:#f00;">'''Suggested changes''' At the end of the third paragraph add "It is important to verify that all files, web pages, etc protected by the password mechanism actually require authentication.  The authentication controls across a web application should be verified against standards such as Application Security Verification Standard (ASVS) Web Application Edition from OWASP."</span>
+<span style="color:#f00;">'''Suggested changes''' At the end of the third paragraph add "It is important to verify that all files, web pages, etc protected by the password mechanism actually require authentication.  The authentication controls across a web application should be verified using standards such as the Application Security Verification Standard (ASVS) Web Application Edition from OWASP."</span>
 ==== 3.1.1 Password Capturing : Storage ====

@@ Line 17: / Line 17: @@
 | style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
   | style="width:25%; background:#cccccc" align="center"|'''Primary'''<br>[mailto:colin.watson(at)owasp.org '''Colin Watson''']
-  | style="width:25%; background:#cccccc" align="center"|'''Secondary'''<br>[mailto:name(at)owasp.org '''TBC''']
+  | style="width:25%; background:#cccccc" align="center"|'''Secondary'''<br>OK, RB, DC
   | style="width:25%; background:#cccccc" align="center"|'''Mailing list'''<br>Please use the [http://lists.owasp.org/mailman/listinfo/global_industry_committee Industry Committee list]
   |}
@@ Line 32: / Line 32: @@
   | style="width:25%; background:#7B8ABD" align="center"| '''Deadlines'''
   | colspan="3" style="width:75%; background:#cccccc" align="left"|
-* 18 May 2009 - Produce initial draft response
+* 18 May 2009 - Produce initial (1st) draft response
 * 18 May 2009 - Circulate to OWASP lists for comment
-* 22 May 2009 - Deadline for comments from OWASP lists
+* 18 May 2009 - Produce interim (2nd) draft response
-* 22 May 2009 - Complete final draft response
+* 26 May 2009 - Deadline for comments from OWASP lists
-* 25 May 2009 - Submit for approval by [[Global Industry Committee]]
+* 26 May 2009 - Complete final draft response
 * 29 May 2009 - Submit to NIST
   |-
@@ Line 64: / Line 65: @@
 === Draft Text version 2 ===
-''TBC''
+==== Comments ====
-=== Draft Text version 1 ===
+Further information:
-==== Comments ====
+* [http://www.owasp.org/index.php/OWASP_Foundation OWASP Foundation]
 ==== 3.1.1 Password Capturing : Storage ====

← Older revision		Revision as of 12:55, 19 May 2009
Line 68:		Line 68:

	=== Draft Text version 1 ===		=== Draft Text version 1 ===
		+
		+	==== Comments ====
		+
		+	''Add comments, additions, changes on draft 1 here please''
		+

	==== 3.1.1 Password Capturing : Storage ====		==== 3.1.1 Password Capturing : Storage ====