Password best practices for administrators

Passwords are one of the most common points of unauthorized access in successful security breaches.

The National Institute of Standards and Technology (NIST) proposes significant changes to the rules governing passwords, upending many of the classic ways to prevent weak passwords. Splunk provides the traditional means to drive more secure passwords and continues to monitor and update security requirements based on customer feedback.

Splunk Enterprise provides configuration options for the following password characteristics:

• Length
• Complexity
• Expiration and password reuse (history)
• Lockout after failed attempts

To set up a password policy, see the following topics:

• Configure Splunk password policies
• Configure a Splunk password policy in Authentication.conf (on Splunk Enterprise only)

Password policy best practices

The following best practices help significantly lower the chances of unauthorized access to Splunk and other systems:

Require a longer password length

Long passwords or passphrases are the best way to secure access. Using passwords of ten or more characters prevents the use of rainbow tables and dramatically inhibits password-cracking software that decodes password hashes. A password is more secure when it requires more characters. The required minimum is 8 characters and you can set a length up to 256 characters.

Require a complex password

Traditional guidance requires the use of multiple character types in a password, such as lowercase and uppercase letters, numbers, and special characters. This helps prevent dictionary words in passwords and increases resistance to brute-force attacks.

Because complex passwords can be difficult to remember and do not add significantly to the strength of passwords, NIST no longer suggests this requirement. However, Splunk Enterprise supplies this option because it is still commonly part of regulatory compliance for many organizations.

Use Password expiration

Traditional guidance is to force users to change passwords four or more times per year. Many compliance regulations require this value be set to 90 days or fewer. NIST guidance no longer recommends this, because users tend to change the last character in their password. As a result, any compromised passwords can be used to guess new passwords. Set the maximum password age to any value from 0 to 3650 days, where a value of 0 means that passwords do not expire.

Password expiration is off by default on Splunk platform instances.

Enforce Password History

Enable password history to ensure that a user's most recent passwords are saved. Any password saved to a user's history cannot be used again. With this policy, you discourage users from alternating between several common passwords.

Password history is off by default.

Use password lockout

Password lockout temporarily locks users out of the system after a certain number of failed attempts. Password lockout is on by default and occurs five attempts. You can specify how many attempts the user has, and how long the lockout period must last. The default is 30 minutes. In less secure environments, you can set the lockout time for longer to be sure that an unverified user cannot access the system.

Password lockout is on by default.