Control: 1.4 Ensure IAM password policy requires minimum length of 14 or greater

Description

Password policies are used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a certain length and are composed of certain characters. It is recommended the password policy require a minimum password length 14 characters and contain 1 non-alphabetic character (Number or “Special Character”).

Remediation

From Console

OCI Native IAM

Login to OCI Console.
Go to Identity in the Services menu.
Select Authentication Settings from the Identity menu.
Click Edit in the middle of the page.
Type the number 14 into the box below the text: MINIMUM PASSWORD LENGTH (IN CHARACTERS).
Select checkbox next to MUST CONTAIN AT LEAST 1 SPECIAL CHARACTER OR MUST CONTAIN AT LEAST 1 NUMERIC CHARACTER

OCI Identity Cloud Service (IDCS)

Login to IDCS Admin Console.
Expand the Navigation Drawer, click Settings, and then click Password Policy.
Click on Change Your Password Policy button.
Update the Password length min size setting to 14
Click Save.
Under The password must contain these characters section, update the number given in Special min setting to 1 or Under The password must contain these characters section, update the number given in Numeric min setting to 1.
Click Save.

Usage

Run the control in your terminal:

powerpipe control run oci_compliance.control.cis_v110_1_4

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run oci_compliance.control.cis_v110_1_4 --share

SQL

This control uses a named query:

select
  tenant_id as resource,
  case
    when
      minimum_password_length >= 14
      and (is_numeric_characters_required or is_special_characters_required)
    then 'ok'
    else 'alarm'
  end as status,
  case
    when minimum_password_length is null then 'No password policy set.'
    when
      minimum_password_length >= 14
      and (is_numeric_characters_required or is_special_characters_required)
    then 'Strong password policies configured.'
    else 'Strong password policies not configured.'
  end as reason
  , tenant_name as tenant
from
  oci_identity_authentication_policy;

Control: 1.4 Ensure IAM password policy requires minimum length of 14 or greater

Description

Remediation

From Console

Usage

SQL

Tags