Repository navigation
DR: Password Requirements policy #62
Description
Overview
We need to document what our password requirements are, so that we can create further issues to get compliance across all our password locations. This needs to cover:
- Password length
- Password complexity
- Max login attempts
Action Items
- Research current best practices
- Write up a Recommendation
- Get approval on recommendation
- Write Decision record
- Get approval
- Add Decision Record to wiki in the appropriate places
- List under "Link to all the decision records" (resource 1.01)
- List under "Records" (resource 1.02)
- Create an issue to write code and implement policy
Resources/Instructions
- 1.01 https://github.com/hackforla/ops/wiki/Decision-Records
- 1.02 https://github.com/hackforla/ops/wiki/Decision-Records-on-Solutions-Adopted
Template for decision record
This is a record in the [Decision Records on Solutions Adopted](https://github.com/hackforla/website/wiki/Decision-Records-on-Solutions-Adopted).
#### Issue
#### Problem Statement
#### Potential Solution
#### Feasibility Determination
Activity
11 remaining items
ale210 commentedon Feb 13, 2025
@bltomlin updated the description to specify what needs to be covered here at minimum
bltomlin commentedon Feb 16, 2025
redacted
ale210 commentedon Feb 20, 2025
@bltomlin this looks really good, can you move the issue to 'Questions/Review' so that we will see it when doing board review. Additionally, can you scope your recommendations to just what is listed in the overview? There are other issues which will track things like monitoring etc
ExperimentsInHonesty commentedon Feb 26, 2025
@bltomlin Please add a new comment that provides what was requested in the scope of the issue at the top. For the items where you did research that was not asked for. Please look at the issue tab for DevOps Security https://github.com/hackforla/devops-security/issues to see if issues that cover those items already exist. If they do, you can move your content to those issues. If they don't, you can make a new issue and put it in the new issue approval column on our project board.
If you have any questions about what I just wrote, please add those questions in a comment and move this issue to the Question column, and add a
Ready for CoP Leadlabelbltomlin commentedon Mar 7, 2025
Issue #62
Problem: We need to document what our password requirements are, so that we can create further issues to get compliance across all our password locations. This needs to cover:
Password length
Password complexity
Max login attempts
Potential Solution:
Minimum: 16 characters.
Longer passwords are encouraged for added security.
Must include a mix of uppercase letters, lowercase letters, numbers, and symbols.
No personal information (e.g., names, birthdays, or common words).
Use a password manager for secure storage.
Accounts lock after 5 failed attempts.
Locked accounts require DevOps-Security verification to reset.
Multi-Factor Authentication (MFA) is required for all critical accounts.
ale210 commentedon Mar 13, 2025
this looks good, approved