TMA-SOPHOS-1.1.5
Ensure password complexity check is enabled
Descrição
This checks all new passwords to ensure that they meet basic requirements for strong passwords. CIS Password Recommendations: Length: 14+ characters for password-only, 8+ for MFA. Composition: Allow all character types; require at least one non-alphabetic, one uppercase, one lowercase and one numeric characters for password-only accounts. Passphrases: Use multiple words for memorability (e.g., "Th3F0rdMust@ngis#1"). Expiration: Change immediately on compromise; annual change as a "backstop". Banning: Check against common, weak, or previously used passwords. MFA: Implement wherever possible; it significantly lowers complexity requirements. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Como é verificado
Método de auditoria: Revisão manual
Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.
Navigate to 'System > Administration > Admin and user settings > Administrator password complexity settings > Enable password complexity check'. Verify that 'Enable password complexity check' is enabled. Ensure that the various password settings to values that are appropriate to your organization. Should be checked for use at least one uppercase and one lowercase letter, include at least 1 numeric character and include at least 1 special character like @,$,!,etc.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Navigate to 'System > Administration > Admin and user settings > Administrator password complexity settings > Enable password complexity check'. Set Enable password complexity check. Set that the various password settings to values that are appropriate to your organization. It is suggested that there at least be some special characters enforced, and that a minimum length be set. Ensure that Minimum Uppercase, Lowercase and Special Characters. Operationally, dictionary words should be avoided for all passwords - passphrases are a much better alternative.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- sophosauthentication
- Referência
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.5 Ensure password complexity check is enabled