3.4 Ensure 'PASSWORD_REUSE_MAX' Is Greater than or Equal to '20'

Information

The PASSWORD_REUSE_MAX setting determines how many different passwords must be used before the user is allowed to reuse a prior password. The suggested value for this is 20 passwords or greater.

Allowing reuse of a password within a short period of time after the password's initial use can make the success of both social-engineering and brute-force password-based attacks more likely.

Solution

Remediate this setting by executing the following SQL statement for each PROFILE returned by the audit procedure.

ALTER PROFILE <profile_name> LIMIT PASSWORD_REUSE_MAX 20;

See Also

https://workbench.cisecurity.org/benchmarks/11760

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: OracleDB

Control ID: 1c579be8c928ea3d322f2cb7f34f0c9db1132a1cf6c1db7ae47c84bc14fe3b95