Page Comparison

...

1. Responsibility and Accountability:

   • All individuals with access to the Company's systems must select strong, secure passwords and are responsible for keeping their passwords confidential.

2. Prohibited Use of Passwords:

   • Passwords must not be shared through non-secure channels, including but not limited to email, social media, and other forms of electronic communication not explicitly approved for secure information exchange.

3. Password Strength and Complexity:

   • Passwords must be at least 12 characters long and include a mix of uppercase letters, lowercase letters, numbers, and special characters. Passwords must not contain personal information, common dictionary words, or easily guessable sequences.

4. Initial Password Use and Change:

   • Default passwords for new accounts must be unique and complex. Users are required to change their password upon the first login to ensure initial account security. Please click here to learn about changing APKey password.

5. Password Expiry and History:

   • Passwords must be changed at least every 365 days. The system will remember the last 4 passwords, and they cannot be reused.

6. Frequency of Password Changes:

   • Users are encouraged to change their passwords more frequently if any suspicion of compromise arises. Mandatory password changes are required after any security incident.

7. Account Lockout Policy:

   • Accounts will be locked after five consecutive failed login attempts and will remain locked for 30 minutes to prevent unauthorized access through brute force attacks.

8. Secure Password Storage:

   • Passwords must be stored securely using salted hashes to prevent unauthorized retrieval and decryption. Clear text storage of passwords is strictly prohibited.

9. Protection of Authentication Credentials:

   • Users must protect their passwords, PINs, security tokens, and other authentication methods. The use of password managers is recommended for secure password storage.

10. Password Reset:

    • Users are permitted to reset their passwords whenever necessary, especially if a compromise is suspected.

11. Production Server Access:

    • Access to production database servers is restricted to authorized personnel only, as determined by the IT Manager.

12. Web-Based Application Authentication:

    • All web-based applications must implement a secure authentication layer, with multi-factor authentication (MFA) strongly recommended for enhanced security.

13. Unattended Sessions:

    • Workstations must be configured to automatically lock after 30 minutes of inactivity to prevent unauthorized access.

...