Description

Ensure the identity domain password policy remembers at least the last 24 passwords for each user, so users cannot switch back to a password they used before. This makes sure that a password which may have been exposed in the past cannot simply be reused.

Rationale

Users often cycle between a small set of familiar passwords. If an old password was leaked or guessed, allowing it to be reused lets an attacker regain access with credentials they already have. Remembering at least 24 previous passwords makes this practically impossible and keeps the benefit of password changes.

Impact

  • Users cannot reuse any of their last 24 passwords

  • Old, possibly compromised passwords stay retired

  • Users must create new passwords when changing them

Default Value

By default, the identity domain password policy remembers only a small number of previous passwords.

Pre-Requisites

  • Identity domain administrator role

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Check the Previous passwords remembered value.

  5. If it is less than 24, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Select Edit password rules and choose Custom.

  5. Set Previous passwords remembered to 24 or more.

  6. Select Save changes.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.

  4. Select Edit password rules and choose Custom.

  5. Set Previous passwords remembered back to its previous value and select Save changes.

Reference