Password Policies

Introduction to Password Policies

Definition: Password policies are security decisions applied to user accounts
based on company security protocols.

Purpose: Helps in streamlining security by applying consistent rules across
multiple user accounts.

Multiple Choice

What is the purpose of the password policy?

• To simplify log in

• To allow unlimited access

• To track user activity

• To enhance security

Benefits of Password Policies

Consistency: Apply the same rules to all users, eliminating the need for
individual policies.

Efficiency: Reduces administrative burden when adding or managing users.

Security: Enforces strong passwords to protect against unauthorized access.

Multiple Choice

How does applying consistent rules to all users improve efficiency?

• It simplifies software installation

• It reduces the administrative burden when adding or managing users

• It increases the frequency of security updates

• It automates all administrative tasks

Password Policy Requirements

Password Composition:

●Must contain uppercase/lowercase characters and alphanumeric
characters.

●Cannot have identical consecutive characters.

Multiple Choice

What is NOT allowed in a properly composed password?

• Special characters

• Alphanumeric characters

• Identical consecutive characters

• Mixed case letters

Account Lockout Policy

Protection Against Brute Force Attacks:

●Locks the account after multiple incorrect password attempts.

●Lock duration: 30 minutes (automatic unlock after).

●Admin privilege to unlock before 30 minutes using Lock Manager tab.

Multiple Choice

What is a common protection mechanism against brute force attacks?

• Encrypting the password

• Locking the account after multiple incorrect password attempts

• Disabling account permanently

• Sending a security alert after one incorrect attempt

Where Password Policies Apply

Applicable To:

●Customization

●B2B REST APIs

●Dashboard

●Mailbox

●QueueWatcher

●Sterling File Gateway

●MySFG login screens

Limitation:

●B2B REST APIs & Customizations UI restrict password length to 30 characters (can be overcome
using third-party tools like CURL, POSTMAN, or REST Client).

Multiple Choice

What is a limitation associated with B2B REST APIs and Customizations UI?

• Password length is restricted to 30 characters

• Only alphanumeric passwords are allowed

• They do not support third-party tools

• Password length must be at least 50 characters

Default Password Policy Values

Parameter

Policy ID

Policy Name

Password Validity

Minimum Length

Maximum Length

Number of Passwords Kept in History

Password Requires Special Characters

Password Change on Next Login

Default Value

Default_user

Default User Policy

60 Days

6 Characters

128 Characters

5

Yes

Yes

Multiple Choice

How long is a password valid according to the default user policy?

• 30 days

• 60 days

• 90 days

• 120 days

Password Policy Tasks

Tasks to Perform:

●Create a password policy

●Search for a password policy

●Edit a password policy

●Delete a password policy

●Edit lockout parameters

●Edit password expiration messages

Multiple Choice

Which action allows administrators to locate an existing password policy?

• Search for a password policy

• Delete a password policy

• Edit lockout parameters

• Edit password expiration messages

Application of Password Policies

Internal User Accounts Only: Maximum flexibility for internal security.

Not Applicable for LDAP: Password policies cannot be applied to external
user accounts in LDAP.

Multiple Choice

To which type of user accounts can password policies be applied for maximum flexibility?

• External user accounts

• Internal user accounts only

• Guest accounts

• Administrator accounts only

Conclusion

Importance: Implementing robust password policies helps secure your
organization from threats.

Call to Action: Review and update your password policies regularly to
maintain strong security.