Skip to content
System access
ASD ISMISM-1597

ASD ISM 1597 Ensuring credential input obscurity

What it says

Credentials are obscured as they are entered into systems.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Passwords and personal credentials are hidden when entered in systems to enhance security.

When you enter a password or personal details into a system, this control ensures that information isn't visible to anyone nearby. This matters because if someone can see your credentials as you type, they could misuse them to access sensitive information or systems they shouldn't.

Why it matters

If credential entry fields are not masked (e.g., password dots), shoulder-surfers or screen recording can capture credentials and enable unauthorised access.

How to implement

  1. IT team should ensure password fields in all systems obscure text by default.

    Implement this by configuring the systems to display dots or asterisks instead of characters in password input fields.

  2. System owners should conduct regular checks to confirm that login screens across all platforms maintain obscurity of credentials.

    This can be done by manually testing each system to ensure that passwords are hidden as they are typed.

  3. Managers should train staff about the importance of entering passwords discreetly and ensuring others cannot see their screens.

    Conduct short workshops or include reminders in newsletters to emphasise the need for privacy during login.

  4. Procurement should ensure any new software or system includes credential obscurity features.

    This can be achieved by including 'password obscurity' as a requirement in purchasing specifications and check during product demonstrations.

  5. IT support should ensure screen protecting films are available for computers and devices prone to shoulder surfing.

    These films can limit viewing angles so only the person directly in front of the screen can read it.

Keep it running

Verify all login and admin forms mask passwords/PINs, including remote sessions; test after updates, and audit configurations to prevent plaintext entry display.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    A list of all systems where credentials are entered.

    Look at

    Whether password fields are set to obscure entries by displaying symbols like dots or asterisks instead of actual characters.

    Good evidence

    Is when all systems show clear evidence of this setup.

  2. Check 2 of 5What an auditor asks for

    Look at

    Attendance lists and session content to ensure it covers the importance of credential obscurity.

    Good evidence

    Is well-attended sessions with presentations that address this specifically.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Recent procurement specifications for software.

    Look at

    Details that require credential obscurity features in new systems.

    Good evidence

    Is clear specifications mandating the feature and documentation showing it was checked during acquisition.

  4. Check 4 of 5What an auditor asks for

    Good evidence

    Is a documented review process with specific checks for credential obscurity at regular intervals.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see the availability list of privacy screens or similar measures.

    Look at

    Records of purchase or distribution of privacy screens to relevant staff or departments.

    Good evidence

    Is evidence that screens have been made accessible to users who need them.

Mappings

Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.5Secure authentication technologies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.