2 cissp ® Official Study Guide Eighth Edition

Control electronic access to files.
Tightly control and monitor electronic access to all 
important data including files containing passwords. End users and those who are not 
account administrators have no need to access a password database file for daily work 
tasks. Security professionals should investigate any unauthorized access to password data-
base files immediately.
Create a strong password policy.
A password policy programmatically enforces the use 
of strong passwords and ensures that users regularly change their passwords. Attackers 
require more time to crack a longer password using multiple character types. Given enough 
time, attackers can discover any password in an offline brute-force attack, so changing 
passwords regularly is required to maintain security. More secure or sensitive environments 
require even stronger passwords, and require users to change their passwords more fre-
quently. Many organizations implement separate password policies for privileged accounts 
such as administrator accounts to ensure that they have stronger passwords and that 
administrators change the passwords more frequently than regular users.
Hash and salt passwords.
Use protocols such as bcrypt and PBKDF2 to salt passwords 
and consider using an external pepper to further protect passwords. Combined with the use 
of strong passwords, salted and peppered passwords are extremely difficult to crack using 
rainbow tables or other methods.
Use password masking.
Ensure that applications never display passwords in clear text on 
any screen. Instead, mask the display of the password by displaying an alternate character 
such as an asterisk (*). This reduces shoulder surfing attempts, but users should be aware 
that an attacker might be able to learn the password by watching the user type the keys on 
the keyboard.