Sarbanes-Oxley password requirements

What is SOX?

The Sarbanes-Oxley (SOX) Act was passed in 2002 by the US government to protect shareholders and the public from accounting errors and fraudulent activities in organizations. SOX compliance requires public firms to identify and protect all financial management resources, including reports, applications, supporting systems, and services, according to the specified standards. Noncompliance can result in fines, imprisonment, or both.

What are the SOX password requirements?

1. Use longer passwords:

Passwords longer than 20 characters are difficult to crack. Hackers have to try numerous different combinations and still might not be able to guess the correct password when it is long enough.

2. Avoid common words:

Using common phrases like "password," "admin," or "12345" in passwords makes them vulnerable to compromises. Passwords like these can be easily guessed during a potential dictionary attack.

3. Go beyond passwords:

Users must be authenticated using multiple identity verification methods so that access to confidential data is secure, even if their passwords are compromised.

4. Reduce human intervention in password management:

When password reset requests are raised to the help desk, there is no identity verification process to ensure that the request is legitimate. Moreover, new passwords are usually given in plain text over a messaging application, which increases the possibility of password theft. Self-service password management would be a more preferred option to overcome such challenges.

Make SOX compliance easy with ADSelfService Plus

ADSelfService Plus enables your organization to meet every password requirement needed to achieve SOX compliance. You can enforce these password requirements using a custom policy, which can be applied to chosen users, groups, or organizational units in AD.

Custom password length

Admins can enforce longer passwords by setting a minimum password length.

Restrict dictionary words and common passwords

Using a built-in dictionary, admins can restrict users from picking common, weak, and compromised passwords.

Multi-factor authentication

Secure machine, application, VPN, and RDP logons with 19 different advanced authentication methods, including biometrics and YubiKey.

Self-service password management

Enable users to reset forgotten passwords and unlock their accounts without involving the help desk.

Benefits of using ADSelfService Plus to comply with SOX mandates

• Enforce OU- and group-based policies: Granularly enforce multiple password policies in the same AD domain based on OU and group memberships.
• Increased password security: Enforce passphrases, and restrict consecutively repeated characters and common character types from passwords.
• Compliance with other regulatory standards: Apart from SOX, ADSelfService Plus also helps your organization stay compliant with NIST, HIPPA, the PCI DSS, and CJIS regulations.