Use Unique Passwords

The password management system allows the user in a registration situation to decide how complex a password is to be set this time and to remember it on behalf of the user.

When using the password management system, e.g. the following principles:

• the system will force the use of unique passwords in the future
• the system warns the user to change old recurring passwords
• the system forces you to choose passwords that are complex enough, of high quality
• the system forces the user to change the temporary password the first time they log on
• the system forces you to change the password that may have been compromised in the data leak
• the system prevents the same passwords from being reused
• the system keeps password files separate from other data and strongly encrypted

A password management system ensures that each account has a unique password. For accounts using Multi-Factor Authentication (MFA), the policy sets a minimum password length of 8 characters. In contrast, accounts not protected by MFA are required to use complex passwords with a minimum of 14 characters to enhance security. These guidelines are part of a broader strategy to maintain password uniqueness and complexity, tailored according to the presence or absence of MFA.

Multi-factor authentication (MFA) is required for administrators in the organization's key data systems.

For example, when first logging in with a password, a one-time identification code can also be sent to the user as a text message. In this case, he has been identified by two factors (knowing the password and ownership of the phone).

Biometric identifiers (e.g. fingerprints) and other devices can also be used for multi-stage authentication. However, it is worth considering the costs and implications for privacy.

Multi-factor authentication (MFA) helps protect devices and data. To apply it, users must have more information in the identity management system than just an email address - for example, a phone number or an attached authenticator application (e.g. Microsoft, Google, or LastPass Authenticator).

To protect from e.g brute force attacks the organisation must use at least one of the following practices:

• Account is locked after 10 failed login attempts
• Limit for login attempts in 5 minutes is 10

In addition the following password practices should be in place:

• Minimum length of a password should be at least 8
• Passwords don’t have maximum length
• Password is changed when it’s integrity is suspected or known to be compromised