documentation_complete: true

title: 'Define Minimum Password Expiration Interval'

description: |-
    Organizations should create an authenticator management policy
    that defines a maximum password age for user accounts accessing JBoss and
    its deployed applications.

rationale: |-
    In combination with password length and complexity, regularly changing
    passwords can defeat many attacks. If a password or password hash is
    intercepted by a malicious party, changing the password can remove access
    or render invalid a cracking attempt on the hash. However, there are risks
    associated with frequently changing passwords. Users may take steps to
    circumvent policy such as using repetitive passwords or using password
    derivatives. Additionally, changing passwords for system or application
    accounts introduces an element of configuration risk. Poorly coordinated
    or documented changes can result in system outages or create other problems.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: IA-5

ocil_clause: 'no appropriate minimum password expiration policy exists'
