Password Policies

Benefits of Password Policies

Consistency: Apply the same rules to all users, eliminating the need for
individual policies.

Efficiency: Reduces administrative burden when adding or managing users.

Security: Enforces strong passwords to protect against unauthorized access.

Password Policy Requirements

Password Composition:

●Must contain uppercase/lowercase characters and alphanumeric
characters.

●Cannot have identical consecutive characters.

Account Lockout Policy

Protection Against Brute Force Attacks:

●Locks the account after multiple incorrect password attempts.

●Lock duration: 30 minutes (automatic unlock after).

●Admin privilege to unlock before 30 minutes using Lock Manager tab.

Where Password Policies Apply

Applicable To:

●Customization

●B2B REST APIs

●Dashboard

●Mailbox

●QueueWatcher

●Sterling File Gateway

●MySFG login screens

Limitation:

●B2B REST APIs & Customizations UI restrict password length to 30 characters (can be overcome
using third-party tools like CURL, POSTMAN, or REST Client).

Default Password Policy Values

Parameter

Policy ID

Policy Name

Password Validity

Minimum Length

Maximum Length

Number of Passwords Kept in History

Password Requires Special Characters

Password Change on Next Login

Default Value

Default_user

Default User Policy

60 Days

6 Characters

128 Characters

5

Yes

Yes

Password Policy Tasks

Tasks to Perform:

●Create a password policy

●Search for a password policy

●Edit a password policy

●Delete a password policy

●Edit lockout parameters

●Edit password expiration messages

Application of Password Policies

Internal User Accounts Only: Maximum flexibility for internal security.

Not Applicable for LDAP: Password policies cannot be applied to external
user accounts in LDAP.

Conclusion

Importance: Implementing robust password policies helps secure your
organization from threats.

Call to Action: Review and update your password policies regularly to
maintain strong security.