AWS
Google CloudOverview
Policy Statement
your organization identified that a solid password policy is perhaps the most important security control an organization can employ. Since the responsibility for choosing good passwords falls on the users, a detailed and easy-to-understand policy is essential.
By default, failed login attempts to systems/applications should be monitored and accounts should automatically be locked and require password change after 5 failed attempts.
Purpose
The purpose of this policy is to specify guidelines for use of passwords. Most importantly, this policy will help users understand why strong passwords are a necessity and help them create passwords that are both secure and useable. Lastly, this policy will educate users on the secure use of passwords.
Scope
This policy applies to any person who is provided an account on the organization's network or systems, including employees, guests, contractors, partners, vendors, etc.
Procedures
Procedures and mapped controls
Password Construction
- Passwords should be at least 10 characters long;
- A password history is enforced. Meaning a user cannot use the last 24 passwords they have set in the past;
- Passwords should be comprised of a mix of letters, numbers, and special characters (punctuation marks and symbols);
- Passwords should be comprised of a mix of upper and lower case characters;
- Passwords should not be comprised of, or otherwise utilize, words that can be found in a dictionary;
- Passwords should not be comprised of an obvious keyboard sequence (i.e., qwerty);
- Passwords should not include "guessable" data such as personal information about yourself, your spouse, your pet, your children, birthdays, addresses, phone numbers, locations, etc.
Mapped controls
Ensure IAM password policy requires at least one uppercase letter
Ensure IAM password policy requires at least one lowercase letter
Ensure IAM password policy requires at least one symbol
Ensure IAM password policy requires at least one number
Ensure IAM password policy requires a minimum length of 14 or greater
Ensure IAM password policy prevents password reuse
Ensure IAM password policy expires passwords within 90 days or less
Password Confidentiality
- Users must not disclose their passwords to anyone
- Users must not share their passwords with others (co-workers, supervisors, family, etc.)
- Users must not write down their passwords and leave them unsecured
- Users must not check the "save password" box when authenticating to applications
- Users must not use the same password for different systems and/or accounts
- Users must not send passwords via email
- Users must not re-use passwords on more than one system/application
Password Change Frequency
To maintain good security, passwords should be periodically changed. This limits the damage an attacker can do as well as helps frustrate brute force attempts. At a minimum, users must change passwords every 90 days. The organization may use software that enforces this policy by expiring users' passwords after this period. your organization uses an IdP solution for enforcing password change. Once a password has been changed it cannot be changed again for 15 days.
Passwords are made inactive or changed to a strong random one when the employee is leaving your organization.
Mapped controls
Ensure access keys are rotated every 90 days or less
Ensure IAM password policy prevents password reuse
Ensure IAM password policy expires passwords within 90 days or less
Ensure user-managed/external keys for service accounts are rotated every 90 days or less
Ensure KMS encryption keys are rotated within a period of 90 days
Password Incident Reporting
Since the compromise of a single password can have a catastrophic impact on your organization's security, it is the user's responsibility to immediately report any suspicious activity involving his or her passwords to the Security Team. Any request for passwords over the phone or email, whether the request came from organization personnel or not, should be expediently reported. When a password is suspected to have been compromised, the Security Team will request that the user, or users, change all his or her passwords.
Password Storage and Transmission
- Passwords must be stored and transmitted securely;
- Default system or application passwords must be changed for Production environments;
- Password can be stored in a Password Management solution;
- The password manager encrypts the password with a master password and an encryption key.
Passwords in Application Development
Application developers must ensure their programs contain the following security precautions:
- Applications must support authentication of individual users, not groups;
- Applications must not have hardcoded, backdoors, persisted password, or access;
- Applications must provide role management, such that one user can take over the functions of another without having to know the other's password;
- Applications must ensure access to Protected data only to entities that have the right access, the right password, and also have MFA enabled.
Query logic
These are the stored checks tied to this policy.
IAM password policy requires at least one uppercase letter
Connectors
Covered asset types
Expected check: eq []
iamPasswordPolicies(where:{requireUppercaseCharacters:false}){...AssetFragment}IAM password policy requires at least one lowercase letter
Connectors
Covered asset types
Expected check: eq []
iamPasswordPolicies(where:{requireLowercaseCharacters:false}){...AssetFragment}IAM password policy requires at least one symbol
Connectors
Covered asset types
Expected check: eq []
iamPasswordPolicies(where:{requireSymbols:false}){...AssetFragment}IAM password policy requires at least one number
Connectors
Covered asset types
Expected check: eq []
iamPasswordPolicies(where:{requireNumbers:false}){...AssetFragment}IAM password policy requires a minimum length of 14 or greater
Connectors
Covered asset types
Expected check: eq []
iamPasswordPolicies(where:{minimumPasswordLength_LT:14}){...AssetFragment}IAM password policy prevents password reuse (24 times)
Connectors
Covered asset types
Expected check: eq []
iamPasswordPolicies(where:{passwordReusePrevention_LT:24}){...AssetFragment}IAM password policy expires passwords within 90 days or less
Connectors
Covered asset types
Expected check: eq []
{ iamPasswordPolicies( where: { OR: [{ maxPasswordAge: 0 }, { maxPasswordAge_GT: 90 }] } ) {...AssetFragment} } Access keys are rotated every 90 days or less
Connectors
Covered asset types
Expected check: eq []
AWSIAM4{...AssetFragment}User-managed/external keys for service accounts are rotated every 90 days or less
Connectors
Covered asset types
Expected check: eq []
GCPIAM5{...AssetFragment}KMS encryption keys are rotated within a period of 90 days
Connectors
Covered asset types
Expected check: eq []
GCP110IAM10{...AssetFragment}
