Overview :
This policy is intended to establish guidelines for effectively creating, maintaining, and protecting passwords.
Purpose :
The purpose of this policy is to establish a standard for creation of strong passwords, and the protection of those passwords.
Scope :
The scope of this policy includes the Corporate, Account, Driver, and Partner User types.
How to impose the Password Policy :
Tick the 'Password Policy' checkbox for Corporate users.
Tick the 'Password Policy For External Users' checkbox for Account, Partner, Driver.
System Default >> Operations
Password length can be set by providing the 'Minimum Password Length' which can be in range of 8 to 15.
Password Policy :
- Must be of at least the minimum length set in system default.
- Have at least one capital letter (A-Z)
- Have at least on symbol out of +/*<>-/?!@#$()
- Max password length is 16 chara
General guidelines :
Weak passwords have the following characteristics which must be avoided:
- The password contains less than eight characters
- The password is a common usage word such as:
- Names of family, pets, friends, co-workers, fantasy characters, etc.
- Computer terms and names, commands, sites, companies, hardware, software.
- Birthdays and other personal information such as addresses and phone numbers.
- Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc.
- Any of the above spelled backwards.
- Any of the above preceded or followed by a digit (e.g., secret1, 1secret)
Strong passwords have the following characteristics which will be followed regardless of system imposed restrictions:
- Are at least eight alphanumeric characters long.
- Are not words in any language, slang, dialect, jargon, etc.
- Contain both upper and lower case characters (e.g., a-z, A-Z)
- Have digits and punctuation characters as well as letters e.g., 0-9, +/*<>-/?!@#$()
- Are not based on personal information, names of family, etc.
Password protection :
- Passwords must not be shared with anyone (including coworkers and supervisors), and must not be revealed or sent electronically.
- Passwords shall not be written down or physically stored anywhere in the office.
- When configuring password “hints,” do not hint at the format of your password (e.g., “zip + middle name”)
- User IDs and passwords must not be stored in an unencrypted format.
- User IDs and passwords must not be scripted to enable automatic login.
Account lockout :
In order to limit attempts at guessing passwords or compromising accounts, an account lockout policy is in effect based on the value of 'Max Login Attempts'.
System Default >> Basic Setup