AuditUnit 4 · Topic 4.2
Configure it: which login settings are too weak?
Check login settings against a password policy.
New to this? Read the topic first: 4.2 Authentication.
Simulation · [4.2.D.1, 4.2.D.2, 4.2.D.3, 4.2.D.4, 4.2.D.5]
Configure it: which login settings are too weak?
A shared drop-in computer must meet the company policy: complex passwords of at least 12 characters, the last 5 passwords remembered, and lockout after 5 failed attempts. Tap every setting that breaks the policy. There are 4.
-
Red flag. Complexity should be enabled so every password mixes uppercase, lowercase, digits and special characters.
-
Red flag. The policy needs at least 12. Short passwords are cracked much faster.
-
Fine. The policy sets no maximum age, and some national standards advise against forced changes. Not a violation here.
-
Red flag. With no history, users can reuse old passwords. The policy needs 5.
-
Red flag. Never locking lets an adversary guess forever. The policy says lock after 5.
-
Fine. A reasonable lockout period once the threshold is set.
Go to the topic: 4.2 Authentication