Revising 'Weak Password Policy' Subcategory about vulnerability-rating-taxonomy HOT 2 CLOSED

Other than policies that allow "a" (no complexity) or "aaaaaaaa" (repeat characters) let's discuss how to classify sequential character passwords like "12345678", "abcdefgh", "qwertyui" or "!@#$%^&*". Credit to @EdisK

from vulnerability-rating-taxonomy.

After consulting with the team we have decided to remove all Insufficient Security Configurability->Weak Password Policy variants and implement the following subcategories:

Insufficient Security Configurability->No Password Policy (P4)
Insufficient Security Configurability->Weak Password Policy (P5)

Going from VRT 1.2 forward we will be only recommending no password policy as low risk issues and rate any existing weak password policy as P5 informational, meeting the customers' expectations and leaving the decision to fix/reward to the client.

from vulnerability-rating-taxonomy.