[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-5":3},{"item":4,"lessons":18,"controls":69,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-5","IA-5","Authenticator Management",378,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Authenticators such as passwords, tokens, keys and certificates must be managed through their life: verify identity at issue, set initial content, ensure strength, handle loss and revocation, change defaults, protect them from disclosure and change them when appropriate.\n\n**In practice.** This means a password policy aligned with current guidance (length over complexity, screening against breached passwords, no forced periodic change without cause), phishing-resistant MFA where possible, secure enrolment and recovery processes, and secrets managers for machine credentials. Auditors look for policy settings, enrolment procedures, evidence that default credentials are changed and how secrets are stored and rotated.\n\n**Common gaps.** Weak account recovery and help desk reset processes are a frequent route around strong authentication. Secrets in source code, scripts and configuration files remain a widespread gap.","Manage system authenticators by:\n  a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;\n  b. Establishing initial authenticator content for any authenticators issued by the organization;\n  c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;\n  d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;\n  e. Changing default authenticators prior to first use;\n  f. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur;\n  g. Protecting authenticator content from unauthorized disclosure and modification;\n  h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and\n  i. Changing authenticators for group or role accounts when membership to those accounts changes.\nDiscussion: Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control [PL-4](#pl-4) or [PS-6](#ps-6) for authenticators in the possession of individuals and by controls [AC-3](#ac-3), [AC-6](#ac-6) , and [SC-28](#sc-28) for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges.\n\nSystems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},393,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"leaked-secrets-and-a-backdoored-ai-tool-give-attackers-cloud-access-in-minutes","Leaked Secrets and a Backdoored AI Tool Give Attackers Cloud Access in Minutes","2026-11-13T16:21:03.622+00:00",{"slug":26,"title":27,"published_at":28},"weak-sql-server-passwords-enable-brute-force-takeover-and-malware-deployment","Weak SQL Server Passwords Enable Brute-Force Takeover and Malware Deployment","2026-11-13T15:20:23.452+00:00",{"slug":30,"title":31,"published_at":32},"stolen-credential-exposes-apify-customer-data-highlighting-mfa-and-secrets-management-gaps","Stolen Credential Exposes Apify Customer Data, Highlighting MFA and Secrets Management Gaps","2026-11-13T13:20:22.45+00:00",{"slug":34,"title":35,"published_at":36},"compromised-github-accounts-weaponized-to-poison-thousands-of-repositories","Compromised GitHub Accounts Weaponized to Poison Thousands of Repositories","2026-11-13T10:20:30.167+00:00",{"slug":38,"title":39,"published_at":40},"compromised-github-accounts-used-to-steal-cloud-secrets-via-injected-cicd-workflows","Compromised GitHub Accounts Used to Steal Cloud Secrets via Injected CI\u002FCD Workflows","2026-11-12T23:20:40.136+00:00",{"slug":42,"title":43,"published_at":44},"weak-sql-server-credentials-open-door-to-miners-and-rat","Weak SQL Server Credentials Open Door to Miners and RAT","2026-11-12T17:21:13.877+00:00",{"slug":46,"title":47,"published_at":48},"64-million-credentials-stolen-via-malware-kits-targeting-unsuspecting-users","6.4 Million Credentials Stolen via Malware Kits Targeting Unsuspecting Users","2026-11-12T17:20:38.235+00:00",{"slug":50,"title":51,"published_at":52},"apify-breach-highlights-credential-and-token-security-risks","Apify Breach Highlights Credential and Token Security Risks","2026-11-12T15:21:18.914+00:00",{"slug":54,"title":55,"published_at":56},"6-million-stolen-credentials-recovered-in-global-malware-takedown","6 Million Stolen Credentials Recovered in Global Malware Takedown","2026-11-12T14:22:33.813+00:00",{"slug":58,"title":59,"published_at":60},"factory-reset-restores-default-root-credentials-in-lenovo-server-firmware","Factory Reset Restores Default Root Credentials in Lenovo Server Firmware","2026-11-12T14:22:14.756+00:00",{"slug":62,"title":63,"published_at":64},"stolen-ai-api-keys-enable-covert-command-and-control-via-claude-code","Stolen AI API Keys Enable Covert Command-and-Control via Claude Code","2026-11-12T12:21:33.905+00:00",{"slug":66,"title":67,"published_at":68},"ai-pentesting-tool-abused-to-steal-aws-credentials-and-access-cloud-secrets","AI Pentesting Tool Abused to Steal AWS Credentials and Access Cloud Secrets","2026-11-12T12:20:40.179+00:00",[70,75,80,85,89,94],{"slug":71,"name":72,"problem":73,"stories":74},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",154,{"slug":76,"name":77,"problem":78,"stories":79},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",122,{"slug":81,"name":82,"problem":83,"stories":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",88,{"slug":86,"name":87,"problem":88,"stories":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":90,"name":91,"problem":92,"stories":93},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",84,{"slug":95,"name":96,"problem":97,"stories":98},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",70,[100,106,111,117,122,125,130,135],{"family":101,"item":102,"code":103,"title":104,"together":105},"gdpr","32","Article 32","Security of processing",272,{"family":5,"item":107,"code":108,"title":109,"together":110},"ac-2","AC-2","Account Management",235,{"family":112,"item":113,"code":114,"title":115,"together":116},"cis","6","Control 6","Access Control Management",204,{"family":112,"item":118,"code":119,"title":120,"together":121},"4","Control 4","Secure Configuration of Enterprise Assets and Software",152,{"family":112,"item":123,"code":124,"title":109,"together":121},"5","Control 5",{"family":126,"item":127,"code":128,"title":128,"together":129},"itil","overview","ITIL",130,{"family":112,"item":131,"code":132,"title":133,"together":134},"7","Control 7","Continuous Vulnerability Management",113,{"family":112,"item":136,"code":137,"title":138,"together":139},"12","Control 12","Network Infrastructure Management",100]