Password Requirements

Password Composition

  • Minimum Length: All passwords must be at least 12 characters long. Longer passwords (16+ characters) are strongly encouraged.
  • Character Requirements: Passwords must include at least:
    • One uppercase letter (A-Z)
    • One lowercase letter (a-z)
    • One numeric digit (0-9)
    • One special character (e.g., !@#$%^&*()_+-=[]{}|;:’",.<>/?`~)
  • Complexity Enforcement: Password creation systems must validate these requirements in real-time and provide feedback to users.
  • Dictionary Word Prevention: Passwords cannot consist solely of common dictionary words, regardless of character substitutions.

Password Restrictions

  • Personal Information: Passwords must not contain:
    • User’s first or last name
    • Username or email address
    • Employee ID number
    • Date of birth (in any format)
    • Phone numbers
    • Sequential characters (e.g., “12345”, “abcde”)
    • Repeating characters (e.g., “aaaaa”, “11111”)
  • Password History: Users cannot reuse any of their previous 5 passwords.
  • Password Aging: Passwords must be changed every 90 days.
    • Users will receive notifications 14 days before expiration.
    • Grace period of 3 days after expiration before mandatory reset.
  • Historical Records: Password history will be maintained for 12 months for audit purposes.

Password Storage and Transmission

  • All passwords must be stored using industry-standard cryptographic hashing algorithms (e.g., bcrypt, Argon2).
  • Plain text passwords must never be stored in any system or database.
  • Password transmission must occur only over encrypted connections (HTTPS, TLS).

Two-Factor Authentication (2FA)

2FA Implementation

  • Mandatory Requirement: 2FA is required for all user accounts accessing company systems.
  • Initial Setup: 2FA must be configured during the initial account creation process before access is granted.
  • Grace Period: New users have a maximum 24-hour grace period to complete 2FA setup.
  • Enforcement: Systems must technically enforce 2FA; it cannot be bypassed by standard users.

Supported 2FA Methods

  • Primary Methods (in order of preference):
    1. Authenticator Applications: TOTP-based applications such as Microsoft Authenticator, Google Authenticator, Authy, or other compatible apps.
    2. Hardware Security Keys: FIDO2/WebAuthn compliant devices (e.g., YubiKey, Titan Security Key) are required for administrator accounts and strongly recommended for all users.
    3. SMS Verification: Only permitted when other methods are unavailable due to hardware limitations. Subject to additional verification of phone number ownership.
    4. Email Verification: Least preferred method, only available as a last resort with documented approval.

2FA Management

  • Recovery Options:
    • Users must generate and securely store backup recovery codes during initial 2FA setup.
    • Recovery codes must be single-use and regenerated after use.
    • A minimum of 10 recovery codes must be provided to each user.
  • Device Management:
    • Users must register all devices accessing company systems.
    • Maximum of 5 trusted devices per user.
    • Devices must be re-verified every 180 days.
  • 2FA Resets:
    • Reset requests require identity verification through multiple channels.
    • Reset approval requires documented manager authorization.
    • All reset actions must be logged for audit purposes.

Account Security

Login Protections

  • Failed Attempt Limits:
    • Maximum of 5 failed login attempts before temporary account lockout.
    • First lockout period is 30 minutes, with escalating timeframes for repeated lockouts.
    • After 3 consecutive lockouts, manual account unlock by IT security personnel is required.
  • Session Management:
    • Automatic logout after 15 minutes of user inactivity.
    • Maximum session duration of 8 hours regardless of activity.
    • Concurrent sessions are limited to 2 per user.
  • Notification System:
    • Users will receive immediate notifications for:
      • Successful logins from new devices or locations
      • Failed login attempts
      • Password or 2FA changes
      • Account lockouts
    • Notifications will be sent via email and in-app alerts when possible.

Risk-Based Authentication

  • Unusual Activity Detection:
    • Login attempts from new geographic locations trigger additional verification.
    • Time-of-day anomalies require additional authentication steps.
    • Rapid traversal between different geographic IP addresses will trigger security alerts.
  • Device Fingerprinting:
    • Browser and device characteristics are analyzed for anomalies.
    • Changes in device fingerprints require re-authentication.

Security Logging

  • Comprehensive Audit Trail:
    • All authentication events must be logged with the following information:
      • Timestamp (in UTC)
      • Username
      • IP address
      • Device information
      • Authentication method used
      • Success/failure status
      • Geographic location
    • Logs must be stored in a tamper-evident format.
    • Authentication logs must be retained for a minimum of 12 months.
    • High-privilege account logs must be retained for 24 months.

User Education and Training

Initial Training

  • Onboarding Requirements:
    • All new users must complete a mandatory security training module before receiving system access.
    • Training must cover password security, 2FA setup, phishing awareness, and social engineering defense.
    • Users must pass a knowledge assessment with a minimum score of 80%.
  • Documentation:
    • Comprehensive user guides for password management and 2FA setup must be provided.
    • Step-by-step visual instructions for all supported 2FA methods must be accessible in the company knowledge base.

Ongoing Education

  • Regular Updates:
    • Quarterly security awareness updates delivered via email and intranet.
    • Mandatory annual refresher training for all users.
    • Targeted training for users who experience security incidents.
  • Security Resources:
    • Password management tool recommendations and usage guides.
    • Guidelines for creating memorable yet secure passphrases.
    • Instructions for reporting suspected security incidents.
    • FAQ section addressing common authentication issues.

Compliance Monitoring

  • Training Compliance:
    • Reports of training completion rates by department.
    • Reminders for users with approaching or overdue training requirements.
    • Escalation to management for employees who fail to complete required training.
  • Effectiveness Measurement:
    • Regular simulated phishing campaigns to test user awareness.
    • Analysis of authentication-related help desk tickets to identify training gaps.
    • Annual security knowledge assessment for all users.

Exceptions and Emergency Access

Exception Process

  • Request Procedure:
    • Formal written request must be submitted to the Information Security team.
    • Request must include business justification, risk assessment, and proposed compensating controls.
    • Approval requires sign-off from:
      • Department Manager
      • Information Security Officer
      • IT Director (for exceptions lasting more than 30 days)
  • Documentation Requirements:
    • All exceptions must be documented in the security exception register.
    • Documentation must include scope, duration, justification, and approvals.
    • Exceptions must include an expiration date not exceeding 90 days.

Emergency Access

  • Break-Glass Procedure:
    • Designated emergency access accounts for critical systems.
    • Multi-person authorization required for emergency access activation.
    • Tamper-evident seals on physical emergency access credentials.
  • Monitoring and Recovery:
    • Real-time alerts when emergency access is initiated.
    • Continuous monitoring during emergency access sessions.
    • Mandatory post-incident review within 24 hours.
    • Password and credential rotation after emergency access use.

Regulatory Compliance

  • Compliance Alignment:
    • All exceptions must be evaluated for impact on regulatory compliance.
    • Exceptions affecting regulated data require additional approval from Compliance Officer.
    • Documentation of exceptions must satisfy audit requirements for applicable regulations.
  • Periodic Review:
    • All exceptions must be reviewed quarterly.
    • Exceptions must be revoked when no longer necessary.
    • Annual report of exceptions must be provided to executive management.

Implementation and Enforcement

Technical Controls

  • Password Management Systems:
    • Enterprise password management solution for secure credential storage.
    • Password policy enforcement through Active Directory or equivalent identity provider.
    • Self-service password reset capability with appropriate identity verification.
  • 2FA Infrastructure:
    • Centralized 2FA management console for administrators.
    • Integration with single sign-on (SSO) solution where applicable.
    • Backup 2FA servers to ensure high availability.

Compliance Monitoring

  • Regular Audits:
    • Monthly automated scans for accounts not using 2FA.
    • Quarterly review of password policy compliance.
    • Annual penetration testing of authentication systems.
  • Reporting:
    • Weekly reports on authentication failures and lockouts.
    • Monthly reports on 2FA adoption and usage.
    • Quarterly compliance reports to management.

Enforcement Measures

  • Non-Compliance Consequences:
    • Accounts not meeting policy requirements subject to temporary restriction.
    • Repeated non-compliance reported to user’s manager.
    • Willful circumvention of security controls subject to disciplinary action.
  • Technical Enforcement:
    • Account provisioning dependent on policy compliance.
    • Automated enforcement of password complexity and history.
    • System-level prevention of authentication without 2FA.

Policy Management

Version Control

  • Current version: 1.0
  • Effective date: [Date]
  • Review frequency: Annual or upon significant technology/threat changes

Responsibilities

  • Policy Owner: Chief Information Security Officer
  • Implementation: IT Security Team
  • Compliance Monitoring: Security Operations Center
  • User Support: IT Help Desk

References

  • NIST Special Publication 800-63B: Digital Identity Guidelines
  • ISO/IEC 27001:2013 Annex A.9: Access Control
  • OWASP Authentication Best Practices