documentation_complete: true

title: 'Define Minimum Password Complexity Requirement'

description: |-
    Organizations should create an authenticator management
    policy that defines a minimum level of complexity for user accounts
    accessing JBoss and its deployed applications. These requirements should
    also restrict passwords from containing dictionary words and reusing
    previous passwords.

rationale: |-
    Complex passwords increase password security and the length of time required
    to decrypt the password. Additionally, complex passwords are less likely to
    be found in password dictionaries. However, there are risks associated with
    requiring overly complex passwords, as users may take steps to circumvent
    policy; such as using repetitive passwords, writing password reminders, or
    writing down their passwords.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: IA-5

ocil_clause: 'no appropriate minimum password complexity policy exists'
