Hp Secure Key Manager Manuel d'utilisateur télécharger pdf (Page 208)

Password expir

ation

The password expiration feature allows you to specify a duration for administrator passwords. By default,

this feature is disabled. When an administrator password expires, the system forces that administrator

to create a new p

assword after logging in with the expired password. (If the administrator is currently

logged in when the password expires, that session continues as normal.)

The duration of passwords is unaffected by changes to the system time (either manual changes or changes

due to NTP synchronization). This accomplishes two objectives: (1) an administrator cannot turn back the

system time to

prevent a password from expiring; (2) it avoids a scenario where many or all passwords

expire simul

taneously due to a large jump forward in the system time.

Password history

The password history feature enables the system to maintain a list of previously-used administrator

passwords for each administrator. When an administrator creates a new password, the system checks

that the entry does not exist on the password list. Once created, the new password is added to the

administrator’s password history.

The password history is only consulted when an administrator attempts to change his or her own

password. It is not checked when one administrator changes another’s password. This accomplishes two

objectives: (1) administrators cannot determine the passwords of other administrators, and (2) it allows

you to reset an administrator’s password to a standardized temporary password.

By default, the password history feature is disabled. The system populates the password history with

passwords created after the feature is enabled. Passwords currently in use when the feature is selected

are not included in the password history. Likewise, passwords assigned during the administrator creation

process are not retained by this feature. All password histories are cleared when the feature is disabled.

Recommendations for managing passwords

Password protection is a high priority. If passwords are not managed properly, they can become

asecurit

y risk. Some key actions to properly manage passwords are presented here. See the HP

StorageW

orks Secure Key Manager Key Protection Best Practices white paper for more information.

Each of th

e four types of passwords on the SKM should be changed on a regular basis.

• Administrator account passwords should be scheduled to change frequently, and in the event of a

security ofﬁcer personnel change.

• User account passwords should be scheduled to change regularly, but less frequently than the

administrator account passwords, and in the event of a security ofﬁcer personnel change.

• Backup

passwords should be scheduled to change regularly, but less frequently than the

admini

strator or user account passwords, and in the event of a security ofﬁcer personnel change.

• Cluster passwords should be changed rarely, if at all.

CAUTION:

The cluster password cannot be changed without deleting the cluster. Care must be taken to ensure that

no information is overwritten during the recreation of the cluster following the password change.

Choose the intervals between scheduled password changes to be short enough so that security is assured,

yet long enough so that the changes do not negatively impact business operations. Time scheduled

password changes so that at least one full-access administrator account is unchanged during the process.

CAUTION:

In addition to all scheduled password changes, immediately change all administrator, user account, and

backup passwords any time a security ofﬁcer takes a new position or leaves the company.

208

Using the Management Console

1 2 ... 203 204 205 206 207 208 209 210 211 212 213 ... 326 327

Commentaires sur ces manuels

Pas de commentaire

Hp Secure Key Manager Manuel d'utilisateur Page 208

Commentaires sur ces manuels

Produits connexes et manuels pour Stockage Hp Secure Key Manager