TMA-SOPHOS-1.1.5
Ensure password complexity check is enabled
Описание
This checks all new passwords to ensure that they meet basic requirements for strong passwords. CIS Password Recommendations: Length: 14+ characters for password-only, 8+ for MFA. Composition: Allow all character types; require at least one non-alphabetic, one uppercase, one lowercase and one numeric characters for password-only accounts. Passphrases: Use multiple words for memorability (e.g., "Th3F0rdMust@ngis#1"). Expiration: Change immediately on compromise; annual change as a "backstop". Banning: Check against common, weak, or previously used passwords. MFA: Implement wherever possible; it significantly lowers complexity requirements. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Как проверяется
Метод проверки: Ручная проверка
Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.
Navigate to 'System > Administration > Admin and user settings > Administrator password complexity settings > Enable password complexity check'. Verify that 'Enable password complexity check' is enabled. Ensure that the various password settings to values that are appropriate to your organization. Should be checked for use at least one uppercase and one lowercase letter, include at least 1 numeric character and include at least 1 special character like @,$,!,etc.
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
Navigate to 'System > Administration > Admin and user settings > Administrator password complexity settings > Enable password complexity check'. Set Enable password complexity check. Set that the various password settings to values that are appropriate to your organization. It is suggested that there at least be some special characters enforced, and that a minimum length be set. Ensure that Minimum Uppercase, Lowercase and Special Characters. Operationally, dictionary words should be avoided for all passwords - passphrases are a much better alternative.
Свойства
- Операционные системы
- Любая
- Теги
- sophosauthentication
- Источник
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.5 Ensure password complexity check is enabled