Authentication Feedback IA-6

Source: NIST SP 800-53 Rev.5, Identification and Authentication family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

IA-6 (Authentication Feedback) is a small but important rule: when someone is logging in, the screen must not show their secret back to them. Passwords should not echo as they are typed, and a failed login should not reveal whether the username or the password was the wrong part. It applies from the Low baseline up.

What good looks like

• Do not echo passwords on screen — show nothing, or fixed dots, as the secret is typed.
• Keep error messages vague: say ‘login incorrect’, not ‘wrong password’ or ‘no such user’, so an attacker cannot tell which half was right.
• Protect the secret on screen and in transit so a shoulder-surfer or a log file never captures it.
• Apply this everywhere a credential is entered — console logins, SSH (Secure Shell), sudo prompts, and web forms.

Framework mapping

• NIST CSF 2.0 — PR.AA-01 — Identities and credentials for authorized users, services, and hardware are managed by the organization

How to move it toward Implemented

• Confirm the console and SSH (Secure Shell) do not echo passwords — the Linux default, but verify no prompt or script has turned echo on (for example, a shell reading a password without read -s).
• Keep login failure messages generic — PAM (Pluggable Authentication Modules) shows ‘Authentication failure’ without saying which field was wrong; leave that default and avoid custom messages that leak which part failed.
• Test it: attempt a login with a bad username and then a bad password, and confirm the same vague message appears both times and nothing prints the secret.
• Attach that test result as hardening evidence on the asset, naming IA-6 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.