How should authentication credentials be protected during transmission and storage according to the policy?

How should authentication credentials be protected during transmission and storage according to the policy?

• A. Encrypt credentials only during transmission.
• B. Render all authentication credentials unreadable during transmission and storage using strong cryptography.
• C. Store credentials in plaintext on protected servers.
• D. Use obfuscation only for storage.

Answer: (B)

Protecting authentication credentials requires that they are safeguarded both in transit and at rest, using strong cryptography. This means sending credentials over secure channels (like TLS with up-to-date ciphers) and storing them in a way that makes them unreadable to unauthorized actors—typically by using strong encryption with proper key management or by storing secure password hashes with proper salting. This dual protection greatly reduces the risk of credential theft whether an attacker intercepts communications or breaches storage. Only protecting them during transmission leaves the stored credentials vulnerable. Storing credentials in plaintext, even on protected servers, is unsafe. Relying on obfuscation for storage is insufficient because obfuscation can be reversed and does not provide real cryptographic security.

Protecting authentication credentials requires that they are safeguarded both in transit and at rest, using strong cryptography. This means sending credentials over secure channels (like TLS with up-to-date ciphers) and storing them in a way that makes them unreadable to unauthorized actors—typically by using strong encryption with proper key management or by storing secure password hashes with proper salting. This dual protection greatly reduces the risk of credential theft whether an attacker intercepts communications or breaches storage.

Only protecting them during transmission leaves the stored credentials vulnerable. Storing credentials in plaintext, even on protected servers, is unsafe. Relying on obfuscation for storage is insufficient because obfuscation can be reversed and does not provide real cryptographic security.