this is susan bradley for cso online today i'm going to talk about zero trust and
not exactly zero trust more like our pathway to xero trust and we're going to start with passwords
but before i start i'm going to remind you of a podcast that's out on cso online talking about the
zero trust model and what you need to do so start there and once you're done come back to my video
so again i'm talking about passwords and i hope by now that you've gone to download and you use the
local administrator password solution or labs now if you have a traditional active directory domain
you should absolutely have this as your starting place
so what this means is each local administrator password is randomized it's protected so that when
ransomware or some other attackers come into your organization they can't harvest a local
administrator password and go through your entire domain so make sure that you have this installed
now if you're a modern organization and you're using intune instead of active directory there's
solutions out there as well go out to the azure marketplace and there's laps for zor laps within
tune and also admin pass password manager for enterprise most of us are in a situation where we
can't yet be zero trust but we can do a better job with the existing password policies that we have
and one of the things we need to do is look at our existing password policy and you can
go out to powershell and use this command and actually see what your password policy is
now this is a a sample domain and you can see i have the older style of password policy meaning
that it says password length of seven it's now recommended to be 14 and in fact since windows
10 1903 these are the recommended recommend recommended settings you want to enforce
password history for 24 you want to not have a maximum password age or a minimum password age
changing these or making these set for every so many days actually encourages users to have less
secure passwords you want to make sure the minimum password length is 14. you want to make sure that
the settings for password must meet complexity is enabled and you want to make sure that that
store passwords were using reversible encryption is always disabled if you say that enabled
again those those passwords will be able to be reversed and you don't want that
now you want to set passwords for the entire domain and you want to go into
group policy on an active directory domain and you want to go and set those policies
and you go under computer configuration policies windows settings security settings
account policies and password policy and again this is where you want to change those settings
originally the minimum password length was seven you want to make sure that's up to
14 that's the new recommendation is 14 and then of course if you want to have even more
perfect password policies you want to do a fine grain password policies and i put a link into the
how to do that on the guide as well so bottom line if you haven't looked at your password
policies for a while time to relook again time to start the process of going to password less
but obviously we're not all there yet so in the meantime review what you got review
your password policies make sure there is strong and balance between usability
and access to your organization until next time this is susan bradley for cso online
you