Introduction › Why Use CA Top Secret? › System Entry Protection › Passwords

Passwords

Password use and validation are the most fundamental mechanisms for protecting ACIDs from unauthorized use. CA Top Secret requires that all ACIDs be password protected by default. A security administrator assigns the first password. The user associated with the ACID can then either change the password immediately, or later when it expires.

Password assignment is controlled by certain CA Top Secret control option values. These values are set and stored within CA Top Secret; however, they can be changed to fit your site’s security requirements at any time.

Password assignment can be controlled in these ways:

• By following rules for changing passwords
• By setting password expiration intervals
• By using password violation thresholds
• By using random password generation

Rules for Changing Passwords

The following rules demonstrate some of the options you can apply to all users of CA Top Secret security:

• The minimum length of a password can be set. New passwords must be at least four characters in length and cannot be exactly the same as, or even a close variant of, the user’s previous password (for instance, ninth and tenth could be considered close variants because they differ by only two letters).
• Passwords can only be changed after a specific interval of time has elapsed (the system default is one day).
• Passwords cannot contain repeating characters and can be required to conform to a mask.
• Passwords that match the userid or the first four characters of any word in the associated (personal) name field, as well as passwords that match entries in a restricted password list, are not allowed.

Password Expiration Intervals

A password expiration interval is the number of days before CA Top Secret forces a user to change his password.

Password Violation

To prevent unauthorized system entry by password guessers, CA Top Secret recognizes a password violation threshold that is enforced system-wide. Once this threshold is exceeded, CA Top Secret automatically suspends the ACID.

Random Password Generation

Random password generation is a feature that lets CA Top Secret automatically generate a random set of characters for a password. A security administrator can instruct CA Top Secret to generate a random password for a user whose password has expired, or the user himself can instruct CA Top Secret to automatically generate a password.