Password testing seems simple, but many nuances can trip up an auditor. In this session, we discuss how to test passwords based on the standards in FISCAM and NIST. We present real examples from the field for each test.

This course is a part of IT Audit Bytes series. The other Segments of this series are:

  1. IT Audit Bytes - Access Control
  2. IT Audit Bytes - Backup and Recovery
  3. IT Audit Bytes - Change Management
  4. IT Audit Bytes - Cybersecurity
  5. IT Audit Bytes - Data Loss Prevention
  6. IT Audit Bytes - Disaster Recovery and BCP
  7. IT Audit Bytes - IT Control Frameworks
  8. IT Audit Bytes - Job Monitoring
  9. IT Audit Bytes - Logging and SEIM
  10. IT Audit Bytes - Network Security and Detection
  11. IT Audit Bytes - Password Management
  12. IT Audit Bytes - Physical Security
  13. IT Audit Bytes - Provisioning and Deprovisioning
  14. IT Audit Bytes - SDLC Controls
  15. IT Audit Bytes - Security Awareness Training
  16. IT Audit Bytes - Separation of Duties Controls
  17. IT Audit Bytes - SOC Reports
  18. IT Audit Bytes - Strategy and Governance
  19. IT Audit Bytes - Third-Party IT Risk Management (TPRM)
Learning Objectives
  • Identify the major elements of password controls.
  • Discover and describe how to perform tests for password controls.
  • Recognize problems that can trip up an auditor.
Last updated/reviewed: February 10, 2025
1 Review (1 rating)

Reviews

5
Anonymous Author
Good course that gives a very good detail explanation of password management. It is very well taught course that explains password vaults, password managent, control testing and some information of increasing the length of passwords as oppose to frequent change maybe the best practice to strengthening a password. Excellent course!
Prerequisites
Knowledge Level: Basic
No advanced preparation or prerequisites are required for this course.
Education Provider Information
Company: Illumeo, Inc., 75 East Santa Clara St., Suite 1215, San Jose, CA 95113
Contact: For more information regarding this course, including complaint and cancellation policies, please contact our offices at (408) 400- 3993 or send an e-mail to .
Instructor for this course
  Course Overview CPE
Course Syllabus
INTRODUCTION AND OVERVIEW
  Introduction to Passwords Management1:02
  Federal Information System Controls Audit Manual9:08
  Control Testing16:06
CONTINUOUS PLAY
  IT Audit Bytes - Password Management26:16
SUPPORTING MATERIAL
  Slides: IT Audit Bytes - Password ManagementPDF
  IT Audit Bytes - Password Management GlossaryPDF
REVIEW AND TEST
  REVIEW QUESTIONSquiz
 FINAL EXAMexam