V6.4.1: Verify that system generated initial passwords or activation codes are securely randomly generated, follow the existing password policy, and expire after a short period of time or after they are initially used. These initial secrets must not be permitted to become the long term password.
ASVS Maturity
V6.4.2
V6.4.2: Verify that password hints or knowledge-based authentication (so-called "secret questions") are not present.
ASVS Maturity
V6.4.3
V6.4.3: Verify that a secure process for resetting a forgotten password is implemented, that does not bypass any enabled multi-factor authentication mechanisms.
ASVS Maturity
V6.4.4
V6.4.4: Verify that if a multi-factor authentication factor is lost, evidence of identity proofing is performed at the same level as during enrollment.
ASVS Maturity
V6.4.5
V6.4.5: Verify that renewal instructions for authentication mechanisms which expire are sent with enough time to be carried out before the old authentication mechanism expires, configuring automated reminders if necessary.
ASVS Maturity
V6.4.6
V6.4.6: Verify that administrative users can initiate the password reset process for the user, but that this does not allow them to change or choose the user's password. This prevents a situation where they know the user's password.