Ensure Password Policy Enforces Length and Rotation

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

For pre-upgrade environments: 1. Sign in as a Security Administrator or IT Security Manager. 2. Navigate to Tools, Security Console, Administration, Password Policy. 3. Verify that: Minimum length is ≥ 14 characters. Password expiration is ≤ 365 days. Password reuse prevention is ≥ 5 previous passwords. Account lockout triggers after ≤ 5 failed login attempts. For EPM and post-upgrade environments (OCI IAM Identity Domain): 1. In the OCI Console, go to Identity & Security, Domains, Security, Password Policy. 2. Confirm the equivalent settings: Minimum length ≥ 14.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Pre-upgrade (Security Console): 1. Navigate to Navigator Tools, Security Console, Administration, Password Policy. 2. Configure the following values: Minimum Length: 14 Require Numbers: No Require Special Characters: No Password Expiration (Days): 365 Prevent Reuse of Last Passwords: 5 Failed Sign-In Attempts Before Lockout: 5 3. Save and communicate changes to all users. EPM & Post-upgrade (OCI IAM Identity Domain): 1. In the OCI Console, open the Identity Domain Security, Password Policy. 2. Configure equivalent parameters for length, complexity, expiration, reuse prevention, and lockout. 3. Save policy updates; they take immediate effect for all users.