Installing CA Enterprise Log Manager - CA Technologies

User and Access PlanningThe default password policies provided with CA Enterprise Log Manager providefor a very soft form of password protection. For example, the default policyallows users to use their user name as their password and allows them to unlockpasswords. It allows passwords never to expire and does no locking based onfailed login attempts. The default options are intentionally set to a very low-levelof password security to allow you to create your own, custom password policies.Important! You should modify the default password policies to match thepassword restrictions in use at your company. We do not recommend running CAEnterprise Log Manager in production environments with the default passwordpolicies!You can disallow these activities, enforce policies on the password attributessuch as length, character type, age, and reuse, and establish a lock policy basedon a configurable number of failed login attempts as part of your custompassword policy.User Name as PasswordPassword Age and ReuseMore information:Configure Password Policies (see page 105)For passwords to be strong, security best practices mandate that passwordsshould not contain or match the user name. The default password policy enablesthis option. While this option may seem useful when setting the temporarypassword for new users, it is a good practice to clear this password policyselection. Clearing this option prevents users from using this kind of weakpassword.Consider the following guidelines when determining age and reuse policies:■■■The password reuse policy can ensure that a given password is not re-usedfrequently. This policy creates a password history. A setting of 0 means thatpassword history is not enforced. A setting greater than 0 specifies thenumber of passwords that are saved and used for comparison when thepassword is changed. A strong password policy should prevent users fromreusing a password for at least a year.The recommended maximum age for a password varies with passwordlength and complexity. One general rule is that an acceptable password isone that cannot be broken by a brute-force attack in less than the maximumallowed age of the password. A good standard for maximum age is 30 to 60days.Setting a minimum age prevents users from resetting passwords many timesduring a single session to work around a reuse restriction policy. A commonbest practice recommendation is 3 days.40 Implementation Guide