Passwords must. 1.1. Be 8 digits in length
Passwords must. ✓ be changed immediately after first use ✓ where stored, be stored in irreversibly strong hashed form ✓ be changed immediately whenever accounts have, or are suspected of, been compromised Passwords must not be: ▪ sent in the same email or other communication as the username to which they relate. Ideally, the username and password should be sent by two different methods e.g. email and SMS text message ▪ blank ▪ the same as or derivation of (e.g. Password123): your Username any part of your name password Venom IT be viewable when entered be written down be shared with anyone be used by unauthorised users to access systems / information they are not authorised to access be based on friends, family, pets, favourite hobbies, bands, sports teams, films etc Passwords on standard user accounts must: ✓ have a minimum password length of 12 case-sensitive alphanumeric characters ✓ be used when carrying out normal day to day work e.g. email or word processing ✓ not use password expiration. The ICO recommends: “As a general rule, get your users to create a strong initial password and only change them if there are pressing reasons, such as a personal data breach,” otherwise, frequent password expiry “causes people to change a single strong password for a series of weak passwords.” System / administrator level accounts must: ✓ have a minimum password length of 15 case-sensitive alphanumeric characters, including at least one special character (e.g. &%$ etc.) where possible ✓ only be used when those privileges are required for the user to carry out their normal role as recorded on the Access Control Matrix ✓ not use password expiration. The ICO recommends: “As a general rule, get your users to create a strong initial password and only change them if there are pressing reasons, such as a personal data breach,” otherwise, frequent password expiry “causes people to change a single strong password for a series of weak passwords.”
