[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-5":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-5","IA-5","Authenticator Management",378,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Authenticators such as passwords, tokens, keys and certificates must be managed through their life: verify identity at issue, set initial content, ensure strength, handle loss and revocation, change defaults, protect them from disclosure and change them when appropriate.\n\n**In practice.** This means a password policy aligned with current guidance (length over complexity, screening against breached passwords, no forced periodic change without cause), phishing-resistant MFA where possible, secure enrolment and recovery processes, and secrets managers for machine credentials. Auditors look for policy settings, enrolment procedures, evidence that default credentials are changed and how secrets are stored and rotated.\n\n**Common gaps.** Weak account recovery and help desk reset processes are a frequent route around strong authentication. Secrets in source code, scripts and configuration files remain a widespread gap.","Manage system authenticators by:\n  a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;\n  b. Establishing initial authenticator content for any authenticators issued by the organization;\n  c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;\n  d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;\n  e. Changing default authenticators prior to first use;\n  f. Changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur;\n  g. Protecting authenticator content from unauthorized disclosure and modification;\n  h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and\n  i. Changing authenticators for group or role accounts when membership to those accounts changes.\nDiscussion: Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, the requirements for authenticator content contain specific criteria or characteristics (e.g., minimum password length). Developers may deliver system components with factory default authentication credentials (i.e., passwords) to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant risk. The requirement to protect individual authenticators may be implemented via control [PL-4](#pl-4) or [PS-6](#ps-6) for authenticators in the possession of individuals and by controls [AC-3](#ac-3), [AC-6](#ac-6) , and [SC-28](#sc-28) for authenticators stored in organizational systems, including passwords stored in hashed or encrypted formats or files containing encrypted or hashed passwords accessible with administrator privileges.\n\nSystems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics (e.g., minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":25,"title":26,"published_at":27},"claude-code-desktop-flaw-enabled-html-based-credential-theft","Claude Code Desktop Flaw Enabled HTML-Based Credential Theft","2026-10-16T18:20:18.997+00:00",{"slug":29,"title":30,"published_at":31},"phishing-smishing-attacks-target-election-officials-ahead-of-2026-midterms","Phishing & Smishing Attacks Target Election Officials Ahead of 2026 Midterms","2026-10-16T16:21:30.17+00:00",{"slug":33,"title":34,"published_at":35},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":37,"title":38,"published_at":39},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":41,"title":42,"published_at":43},"hard-coded-credentials-in-eseecloud-ip-cameras-leave-users-exposed","Hard-Coded Credentials in EseeCloud IP Cameras Leave Users Exposed","2026-10-15T18:21:38.566+00:00",{"slug":45,"title":46,"published_at":47},"nginx-patches-rce-and-tls-auth-bypass-flaws-including-a-20-year-old-bug","NGINX Patches RCE and TLS Auth Bypass Flaws — Including a 20-Year-Old Bug","2026-10-15T16:21:08.659+00:00",{"slug":49,"title":50,"published_at":51},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","2026-10-15T12:20:54.937+00:00",{"slug":53,"title":54,"published_at":55},"ghostaction-credential-theft-hits-1900-github-accounts-and-30000-repos","GhostAction Credential Theft Hits 1,900 GitHub Accounts and 30,000+ Repos","2026-10-15T10:20:51.258+00:00",{"slug":57,"title":58,"published_at":59},"zero-click-sneakpeek-flaw-silently-exfiltrates-developer-credentials-from-claude-code","Zero-Click 'SneakPeek' Flaw Silently Exfiltrates Developer Credentials from Claude Code","2026-10-14T22:21:07.285+00:00",{"slug":61,"title":62,"published_at":63},"zero-trust-is-more-than-a-buzzword-identity-first-always","Zero Trust Is More Than a Buzzword — Identity First, Always","2026-10-14T18:22:29.051+00:00",{"slug":65,"title":66,"published_at":67},"seo-poisoned-fake-vpn-site-harvests-credentials-before-serving-legitimate-installer","SEO-Poisoned Fake VPN Site Harvests Credentials Before Serving Legitimate Installer","2026-10-14T18:22:16.905+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",143,{"slug":75,"name":76,"problem":77,"stories":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",120,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",87,{"slug":85,"name":86,"problem":87,"stories":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",81,{"slug":90,"name":91,"problem":92,"stories":93},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",76,{"slug":95,"name":96,"problem":97,"stories":98},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",66,[100,106,111,117,121,126,131,136],{"family":101,"item":102,"code":103,"title":104,"together":105},"gdpr","32","Article 32","Security of processing",272,{"family":5,"item":107,"code":108,"title":109,"together":110},"ac-2","AC-2","Account Management",235,{"family":112,"item":113,"code":114,"title":115,"together":116},"cis","6","Control 6","Access Control Management",197,{"family":112,"item":118,"code":119,"title":109,"together":120},"5","Control 5",150,{"family":112,"item":122,"code":123,"title":124,"together":125},"4","Control 4","Secure Configuration of Enterprise Assets and Software",149,{"family":127,"item":128,"code":129,"title":129,"together":130},"itil","overview","ITIL",130,{"family":112,"item":132,"code":133,"title":134,"together":135},"7","Control 7","Continuous Vulnerability Management",113,{"family":112,"item":137,"code":138,"title":139,"together":140},"12","Control 12","Network Infrastructure Management",100]