Password Policy Auditor

SKILL.md

---
name: password-policy-auditor
description: Audit password policies and authentication configurations for security compliance. Check password complexity, storage (hashing algorithms), rotation policies, MFA coverage, account lockout, and compliance with NIST 800-63, OWASP, and PCI-DSS guidelines.
---

# Password Policy Auditor

Audit your authentication system against modern security standards. Check password complexity rules, storage practices (bcrypt vs MD5), MFA adoption, account lockout policies, and compliance with NIST 800-63B, OWASP ASVS, and PCI-DSS — then generate a remediation plan.

Use when: "audit password policy", "is our auth secure", "password security review", "NIST compliance", "MFA audit", "authentication hardening", "are we storing passwords safely", or before security assessments.

## Commands

### 1. `audit` — Full Authentication Audit

#### Step 1: Check Password Hashing

```bash
# Find password hashing in code
rg "bcrypt|argon2|scrypt|pbkdf2|sha256|sha512|md5|hashlib" \
  --type-not binary -g '!node_modules' -g '!vendor' -g '!*.test.*' 2>/dev/null

# Check for plaintext password storage
rg -i "password.*=.*['\"]|password.*store|INSERT.*password" \
  --type-not binary -g '!node_modules' -g '!vendor' -g '!*.test.*' 2>/dev/null
```

Rate the hashing algorithm:
| Algorithm | Rating | Notes |
|-----------|--------|-------|
| Argon2id | 🟢 Best | Memory-hard, recommended by OWASP |
| bcrypt | 🟢 Good | Time-tested, work factor ≥ 12 |
| scrypt | 🟢 Good | Memory-hard alternative |
| PBKDF2 | 🟡 Acceptable | Needs ≥ 600K iterations (OWASP 2023) |
| SHA-256/512 + salt | 🔴 Weak | Too fast for password hashing |
| MD5 | 🔴 Critical | Broken, must migrate immediately |
| Plaintext | 🔴 Critical | Unacceptable in any context |

#### Step 2: Check Password Policy Configuration

```bash
# Find password validation rules
rg "password.*length|min.*password|password.*policy|password.*validation|password.*strength" \
  --type-not binary -g '!node_modules' -g '!vendor' 2>/dev/null

# Check for complexity requirements
rg "uppercase|lowercase|digit|special.*char|complexity" \
  --type-not binary -g '!node_modules' -g '!vendor' 2>/dev/null
```

Evaluate against NIST SP 800-63B (2024):

| Requirement | NIST Recommendation | Status |
|-------------|-------------------|--------|
| Minimum length | ≥ 8 characters (15+ recommended) | Check |
| Maximum length | ≥ 64 characters | Check |
| Complexity rules | NOT required (users pick bad passwords with forced complexity) | Check |
| Breached password check | REQUIRED — check against known breach lists | Check |
| Password rotation | NOT required (only on evidence of compromise) | Check |
| Password hints | NOT allowed | Check |
| Knowledge-based auth | NOT recommended (mother's maiden name, etc.) | Check |

#### Step 3: Check Account Security Features

```bash
# MFA implementation
rg "totp|2fa|mfa|authenticator|otp|two.factor" \
  --type-not binary -g '!node_modules' -g '!vendor' 2>/dev/null

# Account lockout
rg "lockout|lock.*account|failed.*attempt|max.*attempt|brute.force" \
  --type-not binary -g '!node_modules' -g '!vendor' 2>/dev/null

# Rate limiting on auth endpoints
rg "rate.limit|throttle|login.*limit" \
  --type-not binary -g '!node_modules' -g '!vendor' 2>/dev/null

# Session management
rg "session.*timeout|session.*expire|max.*session|concurrent.*session" \
  --type-not binary -g '!node_modules' -g '!vendor' 2>/dev/null
```

#### Step 4: Check for Breached Passwords

```bash
# HaveIBeenPwned k-Anonymity API (safe, only sends hash prefix)
python3 -c "
import hashlib, requests
password = 'password123'
sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
prefix, suffix = sha1[:5], sha1[5:]
resp = requests.get(f'https://api.pwnedpasswords.com/range/{prefix}')
for line in resp.text.splitlines():
    h, count = line.split(':')
    if h == suffix:
        print(f'🔴 Password found in {count} breaches!')
        break
else:
    print('✅ Password not found in known breaches')
"
```

#### Step 5: Generate Report

```markdown
# Password Policy Audit Report

## Overall Score: 62/100 (⚠️ Needs Improvement)

## Password Storage
- Algorithm: bcrypt ✅
- Work factor: 10 (🟡 recommend ≥ 12)
- Salt: automatic (bcrypt built-in) ✅
- No plaintext storage found ✅

## Password Policy
| Rule | Current | NIST 800-63B | OWASP | Status |
|------|---------|-------------|--------|--------|
| Min length | 8 | ≥ 8 (15+ recommended) | ≥ 8 | 🟡 |
| Max length | 50 | ≥ 64 | ≥ 128 | ❌ Increase to 128 |
| Complexity | Required | Not required | Not required | 🟡 Remove |
| Breach check | ❌ None | Required | Required | ❌ Add HIBP check |
| Rotation | 90 days | Not required | Not required | 🟡 Remove forced rotation |

## Account Security
- MFA: Available but not enforced (23% adoption) ⚠️
- Account lockout: After 5 failures, 30 min lock ✅
- Rate limiting on /login: 10 req/min/IP ✅
- Session timeout: 24 hours (🟡 consider 8h for sensitive apps)
- Concurrent sessions: Unlimited (🟡 consider limiting)

## Critical Issues
1. 🔴 No breached password checking — users can set `password123`
2. 🔴 Max password length only 50 chars — blocks passphrase users
3. 🟡 bcrypt work factor 10 — increase to 12 (rehash on login)
4. 🟡 MFA not enforced for admin accounts

## Remediation Plan
1. Implement HIBP breach check on registration and password change
2. Increase max password length to 128
3. Remove complexity requirements (per NIST)
4. Remove forced 90-day rotation (per NIST)
5. Enforce MFA for all admin/privileged accounts
6. Increase bcrypt rounds to 12 (transparent rehash on next login)
```

### 2. `compliance` — Map to Specific Standard

Generate compliance checklist for:
- **NIST SP 800-63B** — Digital Identity Guidelines
- **OWASP ASVS v4** — Application Security Verification
- **PCI-DSS v4** — Payment Card Industry
- **SOC 2** — Service Organization Controls
- **ISO 27001** — Information Security Management

### 3. `migrate` — Plan Password Hash Migration

If using weak hashing (MD5, SHA-256), generate migration plan:
- Wrap existing hash with bcrypt (dual-hash during transition)
- Rehash on next successful login
- Force password reset for accounts not logged in within N months
- Preserve audit trail of migration status