Cryptographically-Protected Passwords

Storage means hashed or encrypted, transit means encrypted, everywhere a password lives or moves.

Hashing converts a password into a one-way code that cannot be turned back into the password. Objective [a] covers everything holding passwords: the directory database, application credential stores, the password vault. Objective [b] covers every path a credential travels: sign-in pages, directory binds, service authentications. A modern Windows domain hashes what it stores and encrypts what Kerberos carries, so the work is finding the exceptions.

Kill the cleartext paths by name.

LDAP simple binds on port 389, HTTP sign-in forms, FTP and Telnet carrying credentials, and SMTP authentication without TLS all transmit passwords unprotected. Move LDAP integrations to LDAPS, require TLS on every authentication endpoint, and keep reversible encryption disabled in the domain, because that one setting stores passwords recoverably.

FIPS validation is not in these objectives.

Objectives [a] and [b] ask for cryptographic protection, not FIPS-validated modules. FIPS-validated encryption belongs to SC.L2-3.13.11, which 32 CFR 170.24 ties to protecting the confidentiality of CUI. Do not import that burden into this requirement.

A company-deployed password manager is compliant and in scope.

A vault that encrypts at rest and serves credentials over TLS satisfies both objectives for the passwords it holds. Reversible encryption inside a vault is its design, not a violation. Deploy one deliberately: it displaces the browser-saved passwords and personal accounts that are the shadow alternative. Because it holds the credentials that unlock your environment, it is a security protection asset you account for in scoping.

The passwords spreadsheet fails storage in the plainest way.

Shared spreadsheets of credentials, text files on desktops, and passwords saved in unmanaged browsers are unprotected storage under [a]. The fix is the vault from the previous lesson plus a policy line prohibiting the rest.

Five points ride on this requirement.

32 CFR 170.24 lists IA.L2-3.5.10 among the five-point derived security requirements. 32 CFR 170.21 keeps requirements worth more than one point off a Conditional status plan of action and milestones, the documented list of gaps you commit to close after assessment. The rule names a single exception, and it is not this one. Cleartext credential paths are cheap to find and expensive to leave.