Access Control and Security Governance

Password security relies on the principle that passwords should never be stored in plain text. Instead, systems store a "hash," the output of a one-way mathematical function such as SHA-256, bcrypt, scrypt, or Argon2, applied to the password; because these functions cannot be reversed, a stolen database of hashes should not directly reveal the original passwords. "Salting" adds a unique piece of random data to each password before hashing it, which prevents attackers from using precomputed "rainbow tables" and ensures that even identical passwords produce different hashes across accounts. Guidance has shifted over time: NIST's 2017 publication SP 800-63B moved away from earlier advice mandating frequent forced password changes and arbitrary complexity rules, instead emphasizing longer passphrases, screening against known breached passwords, and the use of password managers.