PL or SQL : Unsafe password management

Unsecure work with passwords.

Passwords must be stored in the database in an encrypted form. The use of passwords in an unencrypted form is unsafe. In particular, if an application uses a password stored in plaintext in a configuration file, this can lead to the application data being compromised.

Developers often believe that the data stored in the configuration file is securely protected. This assumption simplifies the attacker’s job. Good password management guidelines require that a password never be stored in plaintext.

Set secure values for password policy settings. Limit the number of authorization attempts, the session length, control the password characters number and the password complexity.