2cac8686_plication_Security_and_Privacy__Derived_Security_Controls
Insecure storage of passwords [Derived Security Controls] 
Create and maintain a password policy for all types of system users Encourage, and allow, users to choose stronger passwords Discourage users from having the same password on multiple systems Discourage or prevent commonly used passwords Never store or send passwords in plain text Never encrypt passwords unless there are extremely robust key protection and key management processes in place Use one-way hashing of passwords with a long salt value, unique for each user Use a hashing method that is slow (e.g. PBKDF2, bcrypt or scrypt) Do not use weak hashing methods such as MD5 or SHA-1 Review hashing best practice periodically, and build in considerations to allow future changes to the hashing method Ensure password breaches are included in incident report planning
Privacy : Application Security and Privacy
Derived Security Controls