22.6 Password Management
a) IT Security should ensure that effective and interactive password management system is in place to ensure quality of passwords is implemented, such as defined password length and password complexity.
b) Password composition requirements must be implemented, such as numbers, symbols; both upper and lower case alphabet characters, or mnemonics.
c) The display and printing of passwords must be suppressed or masked and all password files stored in the system or transmitted over communication networks must be highly secured, such as using encryption and protected by access controls.
d) All IDs created by the security administrator must be assigned with a default password that expires upon first sign-on.
e) Vendor supplied default passwords must be changed immediately upon first initialization.
f) All system must be able to automatically force all users to change their passwords at the defined period.
g) Users should-ensure that all passwords are promptly changed if the password or system is suspected of being compromised.
h) All systems must maintain a history of passwords and usage threshold where a password cannot be reused.
i) All systems must be able to implement account lockout policy and account lockout threshold ensure user access is locked after specific times of fail attempt.
j) Procedures on managing obsolete user IDs must be implemented. IT Security ensures the user ID and password is automatically disabled by the system and could not be used with immediate effect.
k) All system must be configured for user passwords to expire on the effective date when a staff leaves the Group or moves to a job that does not warrant access to the computer facility.
l) All files held in user’s directories must be purged or reassigned within a reasonable time frame after the staff has leaved the Group.
m) System files holding passwords are protected from unauthorized access.
n) Passwords must never be stored on computer system in an unprotected and hard coded in clear text or consider password encryption