The organization should ensure that passwords used for network and information systems are created and managed securely. This includes defining clear requirements for password creation, validity, and changes for all users and administrators.
When defining these requirements, the organization should consider the following:
- Minimum length: setting a minimum of set characters for passwords
- Character diversity: password must be a combination of uppercase letters, lowercase letters, numbers, and symbols.
- Contextual security: prohibiting the use of personal identifiers (e.g., birthdays, family names) or company-specific terms.
- Pattern prevention: blocking sequential characters (e.g., "123456") and common keyboard patterns (e.g., "qwerty")
- Account separation: Administrative accounts must utilize more stringent requirements than standard user accounts.
- Triggered and scheduled changes: Passwords must be changed immediately if a compromise is suspected. Also a periodic rotation must be set for password changes.
To ensure these standards are met, it is recommended that a certified password management system be used to generate, store, and protect unique, high-strength credentials.
.svg)
