Static usernames and passwords may be stored in application configuration, connection strings, or source repositories and remain valid for long periods. When such a credential is disclosed it can be reused by an unauthorized party until it is rotated, impacting the confidentiality and integrity of the database.
Long-lived Database Credentials are Exposed
CCC.RDMS.TH08
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CP07 | DB Self Managed Credentials | The service always supports database users authenticated by a username and password that the user creates and manages. |
| CCC.RDMS.CP17 | Cloud Identity Authentication | The service may be configured to authenticate database users with short-lived tokens issued to the cloud provider's identity principals, so that no long-lived database password needs to be stored or rotated. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CN08 | Authenticate Users with Cloud Identity | Ensure that database users authenticate with short-lived tokens issued to cloud identity principals, so that no long-lived password exists to be exposed and reused. |