Which practice is required for first-time use credentials or after resets?

Which practice is required for first-time use credentials or after resets?

• A. Reuse a common default password for all users.
• B. Use the same initial value for every user.
• C. Set a unique value for each user, but do not change after first use.
• D. Set a unique value for each user and change immediately after the first use.

Answer: (D)

The key idea is to provision credentials securely by giving each user a unique, one-time credential and requiring a change immediately upon first login or after a reset. This prevents attackers from exploiting default or shared values—the moment a single initial credential is known, it could compromise multiple accounts if reused. Setting a unique value for each user protects individual accounts, and forcing a change right away ensures the initial credential is not retained. If you reused a common default or the same initial value for everyone, or if you didn’t enforce a change after first use, a compromised credential could be used to access other users’ accounts. This one-time-use approach aligns with PCI DSS practices to minimize risk during provisioning and after resets, maintaining stronger access control and accountability.

The key idea is to provision credentials securely by giving each user a unique, one-time credential and requiring a change immediately upon first login or after a reset. This prevents attackers from exploiting default or shared values—the moment a single initial credential is known, it could compromise multiple accounts if reused.

Setting a unique value for each user protects individual accounts, and forcing a change right away ensures the initial credential is not retained. If you reused a common default or the same initial value for everyone, or if you didn’t enforce a change after first use, a compromised credential could be used to access other users’ accounts. This one-time-use approach aligns with PCI DSS practices to minimize risk during provisioning and after resets, maintaining stronger access control and accountability.