CISSP: Certified Information Systems Security Professional

By ISC · Question Mode

QuestionQ183

VerifiedIdentity and Access Management (IAM)

A web application requires users to register before using its services. Users must select a unique username and a password with at least eight characters. Which method MUST be used to store these passwords so that offline attacks are difficult?

Explanation

Password storage must use an adaptive, cost-intensive password-hashing function with a unique random salt per user. The cost factor raises the work required for every offline password guess, while the salt prevents attackers from efficiently using precomputed hashes or sharing work among identical passwords.

Community Discussion

No comments yet. Be the first to start the discussion!