LS-21: Password Parameters Configuration

Control Description

"Password parameters for the network, network devices, operating systems, and databases related to the in-scope applications are configured as follows: • Minimum password length • Maximum password age • Password history • Password complexity"

Plain Meaning

This control requires organizations to configure specific password parameters across all systems to ensure strong password security. The parameters include minimum length, maximum age, password history, and complexity requirements.

Implementation

Password Policy Requirements

Required Parameters

• Minimum Password Length: At least 8 characters (recommended 12+)
• Maximum Password Age: 90 days maximum (recommended 60-90 days)
• Password History: Prevent reuse of last 5-10 passwords
• Password Complexity: Require mix of uppercase, lowercase, numbers, and special characters

System Coverage

• Network infrastructure devices
• Operating systems (Windows, Linux, macOS)
• Database systems
• Application systems
• Cloud services and platforms

Implementation Approach

Password Policy Configuration

• Windows Systems: Configure through Group Policy or local security policy
• Linux Systems: Use PAM (Pluggable Authentication Modules) configuration
• Network Devices: Configure through device management interfaces
• Databases: Set password policies through database configuration
• Cloud Services: Configure through cloud platform security settings

Simple Implementation Steps

1. Define Password Policy: Create organization-wide password policy
2. Inventory Systems: Document all systems requiring password configuration
3. Configure Each System: Apply password parameters to each system
4. Test Configuration: Verify password policies are working correctly
5. Monitor Compliance: Regularly check that policies remain in place
6. Update as Needed: Modify policies based on security requirements

Password Policy Standards

• Minimum Length: 12 characters for all systems
• Maximum Age: 90 days for most systems, 60 days for critical systems
• Password History: 10 passwords for critical systems, 5 for others
• Complexity: Require 3 of 4 character types (uppercase, lowercase, numbers, symbols)

Key Success Factors

1. Comprehensive Coverage: All systems configured with password policies
2. Strong Parameters: Use strong password requirements
3. Consistent Application: Apply policies consistently across all systems
4. Regular Monitoring: Verify policies remain in place
5. User Education: Train users on password requirements

Common Pitfalls to Avoid

• Inconsistent Policies: Different password requirements across systems
• Weak Parameters: Using weak password requirements
• No Monitoring: Not verifying policies are still in place
• Poor Communication: Not informing users of password requirements