Description

Ensure the identity domain password policy that applies to users requires a minimum password length of at least 14 characters. Longer passwords are much harder to guess or crack, and current CIS guidance favors length over complex character rules.

Rationale

Short passwords can be cracked quickly with brute-force and dictionary attacks, especially when attackers use lists of common passwords. Requiring at least 14 characters greatly increases the number of possible passwords and makes these attacks far less practical. This protects Console accounts, especially those without MFA.

Impact

  • New and changed passwords must be at least 14 characters

  • Makes brute-force attacks much harder

  • Users may need to choose longer passwords

Default Value

By default, the identity domain password policy requires fewer than 14 characters, so it must be changed to a custom policy to meet this check.

Pre-Requisites

  • Identity domain administrator role

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Check the Password length (minimum) value.

  5. If it is less than 14, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Select Edit password rules and choose Custom.

  5. Set Password length (minimum) to 14 or more.

  6. Select Save changes. In the dialog, optionally select Force all users to set a new password on their next login, and select Save changes again.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Select Edit password rules and choose Custom.

  5. Set Password length (minimum) back to its previous value and select Save changes.

Reference