Standard Password Best Practices

[Nick_Parker]

Hi everyone,

 

Does anybody have a document or know somewhere that I can find a Standard Password Practices / Policy?

We recently had an audit and they said that there is a flaw in our IT security as staff do not change their passwords often enough. At the moment we force a change every 90 days, minimum of 4 characters and the last password is remembered. What does everyone else use?

[mac_shinobi]

Where I work as far as I am aware

 

* At least 8 characters long

* Must contain at least an uppercase character

* Must contain at least 2 numerical digits ie 29

* Changes more frequently ( Think its 60 days as apposed to 90 )

* Remembers the last 28 passwords ( which imo is too much ) - changing this to say 10 or even 5 would be good

* Also we don't do this as far as policy etc but I normally include at least a symbol whether its a space, ampersand, etc

[mjs_mjs]

here its;

 

* 6 character min,

* changes every 42 days,

* last 10 passwords remembered.

 

irrc.

[bio]

The SANS whitepapers are allways a good place to start.

 

bio...

[Nick_Parker]

Thanks guys, appreciate your input!