Password Management Guidelines

Transcription

1 Unified Cntract System Passwrd Management Guidelines Versin 2.5 Revisin date: Authr:J.Thiyagarajan Cpyright 2006 by Hexaware Technlgies Limited All rights reserved. All text and figures included in the manual are the exclusive prperty f Hexaware Technlgies, and may nt be cpied, reprduced, r used in any way withut the express permissin in writing f Hexaware Technlgies.

2 Unified Cntract System DOCUMENT HISTORY Dcument Lcatin This is a snapsht f an n-line dcument. Paper cpies are valid nly n the day they are printed. Refer t the authr if yu are in any dubt abut the currency f this dcument. Revisin Histry Date f this revisin: 03 July 2006 Date f next revisin (date) Revisin Number Revisin Date Summary f Changes Revised By Draft Thiyagu Baselined Thiyagu Jun-06 Revised fr LDAP / cmpare with IS Nisha Jun-06 Based n review cmments f KG Nisha Jun-06 Basd n review cmments f Thiyagu Nisha Jun-06 Based n cmments f Elang revised table at end KG Jul-06 Changed the passwrd guidelines t give examples KG Apprvals This dcument requires fllwing apprvals. Signed apprval frms are filed in the Quality sectin Name Title (name) (title) Distributin This dcument has been distributed t Name Title HELIX prtal (title) References This dcument is based n and refers t the fllwing dcuments: N. Authr Title Reference Versin n. Date Pages 1 InfSec Infsec Plicy HELIX prtal (Versin n.) (Date) (Pages)

3 Unified Cntract System PASSWORD MANAGEMENT GENERAL GUIDELINES FOR USERS USER IDS CONVENTIONS: PASSWORD POLICIES PASSWORD FOR NEW USERS CHANGING PASSWORD FORGOTTEN PASSWORD CHANGE SECURITY TOKEN USER PASSWORD MANAGEMENT GUIDELINES GIVEN BY INFOSEC GROUP... 8

4 PASSWORD MANAGEMENT 1.1 GENERAL GUIDELINES FOR USERS Fr all applicatins the emplyee id is t be used as the user id. Three digit Ids like 976 shuld be entered as 0976 If yu have frgttn yur passwrd yu can use the Frgt Passwrd ptin explained belw. But yur id shuld have been registered in the HRMS database by yur lcal HR representative, fr yur ld passwrd t be mailed t yur mail bx. Once it is updated in HRMS it will be synchrnized with the Helix database by the prcess that runs every ne hur. The applicatins that will be synchrnized by the Change Passwrd ptin prvided n Helix screen are : MMS Help@Hexaware Autlib Cckpit Hex!Flks Ewise PllVault Hex::Frum mybenefits Time & Billing Resurce Management HR DashBard KART 1.2 USER IDS CONVENTIONS: The user id fr all Emplyees shall be their Emplyee Ids as generated by the PepleSft HRMS system, and shall be treated as a character string nly if the Emplyee Id is a 3 digit id then the digit 0 is t be prefixed t the Emplyee id. In ther cases the Emplyee id can be fur r mre than fur characters length. In special cases where the user is nt an emplyee f the Cmpany a alpha/alphanumeric string can be allwed t be the user id Examples f UserId : 0133, 6789, 12345, HelpDeskRep Passwrd Management Guidelines Versin 2.5 Page 4 f 8

5 1.3 PASSWORD POLICIES The plicies that are t be fllwed fr passwrds f user accunts fr all the applicatins delivered by Internal Systems Grup are listed belw in cmpliance with InfSec plicies n Passwrd Management. Passwrd cmplexity is enabled. Passwrd shuld cnfrm t the fllwing rules 1) The passwrd shuld be a minimum f 9 characters and max 12 characters 2) It shuld have at least any three f the fllwing fur types 1. An UPPER CASE character ( A t Z ) 2. A lwer case character ( a t z ) 3. A numeral ( 0 t 9 ) 4. A Special Character (!@#$%&()+={};<>,.?/\ ) 3) The passwrd shuld include at least ne alphabet and ne digit as in examples : MyWrd123, $uperman2006, frget(me)nt 4) The passwrd shuld NOT use the wrds r frmats given belw (irrespective f case) a. pass, pass123, passwrd, passwrd123, Hexaware, Hexaware123 b. passnnnn, passwrdnnnn r HexawareNNNN < NNNN is the emplyees id> c. Emplyees First Name and/r Last Name 5) The New passwrd shuld nt be same as the current passwrd. The default passwrd shuld be changed at the time f first time lgin. All passwrds are valid fr a maximum perid f ne mnth. Maximum f 7 passwrds will be remembered in histry. Accunts assciated with a passwrd will be lcked after 6 cnsecutive failed lgin attempts. Accunt lckut duratin will be 30mins after which it will be autmatically unlcked. Passwrd change shall be frced during the first lgin. Users can change their passwrds whenever necessary. Users can change their Security Tken whenever they want. When passwrds are reset and temprary passwrds are issued t users, prper validatin is carried ut by cnfirming Date f Birth and Security tken. System shall display warning message fr users t change the passwrd, frm 15th day f last successful passwrd change. Passwrd Management Guidelines Versin 2.5 Page 5 f 8

6 1.4 PASSWORD FOR NEW USERS Any new emplyee id created will be given access t almst all applicatins immediately based n their rle. Yur recrd will be asssigned a default passwrd. T get the default passwrd use the Frgt Passwrd functin explained in sectin 1.6. After getting the passwrd thrugh , yu need t change it befre first use as explained in sectin CHANGING PASSWORD A menu has been prvided n all pages (under User Inf menu) and a link in the lgin page t enable changing the passwrd by the users.. The user is required t prvide the emplyee id and the current passwrd fr registering a new ne. If the current passwrd is a default passwrd like passwrd123 r pass r pass2614 (in any case), the user shuld prvide his/her date f birth as additinal prf. The Date f Birth prvided will be validated against the data frm HRMS. This is meant t ensure that yur passwrd is nt changed by thers. If the user des nt have a Security tken, he/she will be re directed t the Change Tken screen where user can chse a tken. On creating the tken, the passwrd will be changed. If the user already has a Security tken, the passwrd will be changed there itself. If the current passwrd is nt knwn, the user shuld use the Frgt Passwrd link r buttn explained belw. The new passwrd will be stred in an encrypted frm in the database. The passwrds f users wh changed will be synchrnized t ther applicatins like Help@Hexaware, MMS, Autlib, HexFrum and EWise by the prcess that runs every ne hur. Fr ther applicatins, the new passwrd can be used immediately. The new passwrd given shuld cnfrm t the rules given in the previus sectin f this dcument. 1.6 FORGOTTEN PASSWORD A menu is prvided n all pages (under User Inf menu) ) and a link in the lgin page t enable getting the frgtten passwrd by the users. This is expected t almst eliminate the need fr the users t apprach the Internal Systems Grup r STG r a system administratr t help resetting the passwrd. The user is expected t cntact ISG Help Desk ONLY when the passwrd received using this methd des nt wrk. Enter yur Emplyee id n the screen. Als t ensure that yur passwrd is nt accessible t thers, yu are required t prvide yur Date f Birth as mentined in HRMS and tken(if it exists) and cnfirm yur id. If the user has a Security tken, he/she will have t chse the apprpriate questin he/she previusly selected and answer f the tken he/she recrded. Once the questin/ tken is crrect and Date f Birth is matched successfully against HRMS, the user wuld be asked t cnfirm the id t which the new temprary passwrd is t be mailed. Upn cnfirmatin, the passwrd will be mailed t the fficial mail id. Then the user can change the passwrd as mentined in the previus sectin. If yur Date f Birth r id des nt match with the the inf available in HRMS, the user shuld cntact the HR representative t get it crrected in Peplesft HRMS applcatin first s that it can be reflected in all applicatins. The changes in HRMS will be reflected in all ther internal applicatins every ne hur. Remember nt t frward the mail received thus t any ne, even t ISG HELP id, since it cntains yur passwrd Passwrd Management Guidelines Versin 2.5 Page 6 f 8

7 1.7 CHANGE SECURITY TOKEN A link has been prvided n lgin t enable changing the Security tken by the users. This functin can be used t create r change Security tken. - Enter yur emplyee id and date f birth. - Then chse a questin and an answer fr the chsen questin and submit. - The Security tken is created with the cmbinatin f questin and answer - Select a questin f yur chice frm the list and give yur respnse t it. Passwrd Management Guidelines Versin 2.5 Page 7 f 8

8 1.8 USER PASSWORD MANAGEMENT GUIDELINES GIVEN BY INFOSEC GROUP The plicies given in the Infrmatin Security Prcedure Manual are listed belw : Sl. N Plicy in IS Passwrd cmplexity shall be enabled in dmain cntrller. All passwrds are valid fr a maximum perid f ne mnth All user passwrds will be f minimum 9-character length. Passwrds are nt shared and never displayed n the screen in clear text User Ids assciated with a passwrd are disabled after nt mre than 6 cnsecutive failed lg in attempts. STG Manager shall mnitr such failed lgin attempts peridically and recrd the incidents. Passwrd change shall be frced during the first lgin. Use f alpha numeric passwrds with ne cmpulsry special character shall be frced by the applicatin. Passwrds fr all database instances are unique and maintained in a sealed envelpe The abve guidelines are fllwed fr SNMP cmmunity strings The users can change their passwrds whenever necessary The User passwrds/access rights are revked when an emplyee leaves the rganizatin. Any resignatins / terminatins / transfers shuld be intimated t STG Head / manager by the HR manager fr suitable revcatin / changes t access rights. When passwrds are reset and temprary passwrds are issued t users, prper identificatin f the user shuld be first carried ut Passwrds shuld never be sent via r disclsed during telephnic cnversatins. System shall display warning message fr users t change the passwrd, frm 15th day f last successful passwrd change IS Plicy Addressed / ISG will mnitr N/A / autmated by data update in PepleSft HRMS ISG will mnitr this Passwrd Management Guidelines Versin 2.5 Page 8 f 8