If you’re planning on taking the Security+ exam, you should have a basic understanding of using password policy settings in Group Policy.
For example, can you answer this question?
Q. Developers in your organization have created an application designed for the sales team. Salespeople can log on to the application using a simple password of 1234. However, this password does not meet the organization’s password policy. What is the BEST response by the security administrator after learning about this?
A. Nothing. Strong passwords aren’t required in applications.
B. Modify the security policy to accept this password.
C. Document this as an exception in the application’s documentation.
D. Direct the application team manager to ensure the application adheres to the organization’s password policy.
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Using a Password Policy
A common group of settings that administrators configure in Group Policy is the password policy settings. A password policy ensures that users create strong passwords and change them periodically.
Password policies typically start as a written document that identifies the organization’s security goals related to passwords. For example, it might specify that passwords must be at least eight characters long, complex, and users should change them every 45 days. Administrators then implement these requirements with a technical control such as a technical password policy within a GPO.
The following figure shows the Local Group Policy Editor with the password policy selected in the left pane. The right pane shows the password policy for a Windows system and the following text explains these settings:
Password policy in a Windows domain
- Enforce password history. Some users will go back and forth between two passwords that they constantly use and reuse. However, password history remembers past passwords and prevents the user from reusing previously used passwords. For example, setting this to 3 prevents users from reusing passwords until they’ve used 3 new passwords. Similarly, setting it to 24 prevents users from reusing passwords until they’ve used 24 new passwords.
- Maximum password age. This setting defines when users must change their password. For example, setting this to 45 days causes the password to expire after 45 days. This forces users to reset their password to a new password on the 46th day.
- Minimum password age. The minimum password age defines how long users must wait before changing their password again. If you set this to 1 day, it prevents users from changing their passwords until 1 day has passed. This is useful with a password history to prevent users from changing their password multiple times until they get back to the original password. If the password history is set to 24 and the minimum password age is set to 1 day, it’ll take a user 25 days to get back to the original password. This is enough to discourage most users.
- Minimum password length. This setting enforces the character length of the password. It’s common to require users to have passwords at least 8 characters long, but some organizations require users to have passwords as long as 15 characters.
- Password must meet complexity requirements. This setting requires users to have complex passwords that include at least three of the four character types (uppercase letters, lowercase letters, numbers, and special characters).
- Store passwords using reversible encryption. Reversible encryption stores the password in such a way that the original password can be discovered. This is rarely enabled.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
If an administrator creates the initial password for a user or resets the password, the administrator should set the password to expire immediately. This is the same as a password reaching its maximum age and it forces the user to reset the password immediately when logging on for the first time. If more than one person knows the credentials for an account, the credentials no longer uniquely identify the individual—someone else could log on with the same credentials, and even if the system logged the event, you can’t prove who did it.
Remember this
Password policies include several elements. The password history is used with the minimum password age to prevent users from changing their password to a previously used password. Maximum password age causes passwords to expire and requires users to change their passwords periodically. Minimum password length specifies the minimum number of characters in the password. Password complexity increases the key space, or complexity, of a password by requiring more character types such as special characters.
Q. Developers in your organization have created an application designed for the sales team. Salespeople can log on to the application using a simple password of 1234. However, this password does not meet the organization’s password policy. What is the BEST response by the security administrator after learning about this?
A. Nothing. Strong passwords aren’t required in applications.
B. Modify the security policy to accept this password.
C. Document this as an exception in the application’s documentation.
D. Direct the application team manager to ensure the application adheres to the organization’s password policy.
Answer is D. The application should be recoded to adhere to the company’s password policy, so the best response is to direct the application team manager to do so.
Application passwords should be strong and should adhere to an organization’s security policy.
It is not appropriate to weaken a security policy to match a weakness in an application.
Nor is it appropriate to simply document that the application uses a weak password.
