+Password Policies

Password Policies

Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures:

Windows Systems:

  • Use Group Policy Management Console (GPMC) to configure:
  • Minimum password length (e.g., 12+ characters).
  • Password complexity requirements.
  • Password history (e.g., disallow last 24 passwords).
  • Account lockout duration and thresholds.

Linux Systems:

  • Configure Pluggable Authentication Modules (PAM):
  • Use pam_pwquality to enforce complexity and length requirements.
  • Implement pam_tally2 or pam_faillock for account lockouts.
  • Use pwunconv to disable password reuse.

Password Managers:

  • Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.

Password Blacklisting:

  • Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.

Regular Auditing:

  • Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.

Tools for Implementation

Windows:

  • Group Policy Management Console (GPMC): Enforce password policies.
  • Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.

Linux/macOS:

  • PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules.
  • Lynis: Audit password policies and system configurations.

Cross-Platform:

  • Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords.
  • Have I Been Pwned API: Prevent the use of breached passwords.
  • NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

Krav

3. Relaterade regleringar

Regleringar

Länkade ärenden

Länkar
is related to Mitigations
blocks Network Address Translation Traversal
blocks Cloud Accounts
blocks Reversible Encryption
blocks Credentials in Registry
blocks Pass the Ticket
blocks Private Keys
blocks Silver Ticket
blocks Network Boundary Bridging
blocks NTDS
blocks Kerberoasting
blocks Valid Accounts
blocks Unsecured Credentials
blocks Credential Stuffing
blocks Password Cracking
blocks Use Alternate Authentication Material
blocks Forced Authentication
blocks DCSync
blocks Modify Authentication Process
blocks Security Account Manager
blocks AS-REP Roasting
blocks LSA Secrets
blocks Software Deployment Tools
blocks OS Credential Dumping
blocks Cached Domain Credentials
blocks Local Accounts
blocks Proc Filesystem
blocks /etc/passwd and /etc/shadow
blocks Default Accounts
blocks Modify System Image
blocks Password Guessing
blocks Keychain
blocks SSH Hijacking
blocks Remote Service Session Hijacking
blocks Domain Accounts
blocks Credentials from Password Stores
blocks Password Spraying
blocks Steal or Forge Kerberos Tickets
blocks Brute Force
blocks Credentials from Web Browsers
blocks Downgrade System Image
blocks Password Policy Discovery
blocks Remote Services
blocks Password Managers
blocks SMB/Windows Admin Shares
blocks LSASS Memory
blocks Credentials In Files
blocks Patch System Image
  • MITREATTACK -

    EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

    DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.