ASD ISM 2078 Ensure passwords are not common or compromised

IT team should implement password management tools: Use software that checks if passwords are on lists of known compromised or commonly used passwords.

This involves integrating with online services that maintain these lists, to automatically flag or prevent unsafe passwords.

System administrators should set up password policies: Develop and enforce rules that require employees to create complex passwords.

This can be done through settings in your systems that demand a mix of letters, numbers, and special characters.

HR should educate staff on password importance: Organise regular training sessions to explain why secure passwords matter and how to create them.

Use examples of breaches caused by weak passwords to make it relatable.

IT support should perform regular audits of user passwords: Conduct checks to ensure passwords haven't been compromised by using tools that compare them to known databases of breached passwords.

Schedule audits at regular intervals and report findings.

Management should ensure usage of multi-factor authentication: Require all staff to not only use passwords but also verify their identity through another method, such as a code sent to their phone.

This adds an extra layer of security even if a password gets compromised.