Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 24: Information Security Policies for SharePoint Products and Technologies 663
■ Periodic forced change in passwords
■ Method to manage expired passwords
■ Authorized means to transmit new passwords to remote users
■ Limits on consecutive attempts to enter a password
■ Acceptance or prohibition of single sign-on services
■ Prohibition of passwords sent through e-mail
■ Requirement for encrypted storage of passwords
■ Reliance on domain services for authentication
■ Requirement for non-anonymous authentication before access to information
is allowed
■ Use of duress passwords (Duress passwords trigger scripts during a duress
situation—that is, if a gun is pointed at your head and you are asked to log on to
the server, a duress password would log you on, but because of the password
entered, a script would be triggered to delete all predetermined sensitive data.)
■ Requirement to change all administrative passwords if any have been compromised
■ Password sharing prohibition
■ User responsibility for all actions taken with his username and password
combination
■ Security notice in logon system banner
■ Prohibition against leaving systems without logging off or locking the system
■ Use of biometric devices required for logon to portal
■ Use of smartcard devices required for logon to portal system
Note Throughout this chapter, we will introduce issues that should be considered
when writing your policies. Each issue introduced might or might not
apply to your environment. For example, some organizations might have a
strong password complexity policy while another environment might not due
to culture, industry, or other factors. We are not recommending that each
issue be implemented as presented here, only that each issue should be
considered as the policies are written.
Most of these issues relating to password policies should be covered in your network
policy, but one that directly affects SharePoint Products and Technologies is the