InfoWARE Password Policy Enforcement
InfoWARE provides for a very powerful yet flexible password policy that administrators can configure to meet their security policy requirements. Below is a table that describes each policy requirements
|
Password Policy |
Default |
Weak |
Medium |
Strong |
Very Strong |
|
Minimum Password Length |
6 |
6 |
6 |
8 |
12 |
|
Requires Digits |
No |
No |
Yes |
Yes |
Yes |
|
Require Mixed Case |
No |
No |
Yes |
Yes |
Yes |
|
Disallow UserName Sequence in Password |
No |
No |
No |
No |
Yes |
|
Requires Special Charactars |
No |
No |
No |
Yes |
Yes |
|
Maximum Character Sequence Count |
All |
4 |
4 |
3 |
3 |
|
Password Expiry (Days) |
30 |
30 |
30 |
30 |
30 |
|
LockoutDuration (Minutes) |
0 |
0 |
5 |
30 |
60 |
|
Lockout Threshold (number of tries) |
3 |
3 |
3 |
3 |
3 |
In addition, our security system does the following
- Maintains an internal dictionary of commonly used password phrases and disallows them when found to be used. We continuously update this internal list as research dictates. We use IEEE as well as other scientific publications to keep abreast of this continuously changing field
- InfoWARE security uses a special algorithm to check passwords for well known sequences based on research data from the security industry. Some of the sequences we detect include,
- Alphabetic sequence : For example “1234”, “defghijk”, etc
- Querty US KeyBoard sequence : For example, “xcvbn”, “yuiop[]\”, etc
- Querty UK keyboard sequence : For example, “!”#$%^&” etc
- Azerty keyboard sequence : For example, “zertyui”, “qsdfg” etc
Please note: The sequences are not limited to the length of the examples above. InfoWARE detects sequences irrespective of length. Also, a failure is triggered only if there are at least 3 characters are found in sequence. This is done to avoid disallowing longer passwords which may have accidental sequences.
- InfoWARE detects Elite encoded passwords (which uses the 1337/Leet substitution approach) then implements a reverse substitution before applying policy checks
