← Back to Okta Identity as a Service (IDaaS) Security Technical Implementation Guide

V-273200

CAT II (Medium)

Okta must enforce 24 hours/one day as the minimum password lifetime.

Rule ID

SV-273200r1098867_rule

STIG

Okta Identity as a Service (IDaaS) Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-004066

Discussion

Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement. Restricting this setting limits the user's ability to change their password. Passwords must be changed at specific policy-based intervals; however, if the application allows the user to immediately and continually change their password, it could be changed repeatedly in a short period of time to defeat the organization's policy regarding password reuse. Satisfies: SRG-APP-000173, SRG-APP-000870

Check Content

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy, verify "Minimum password age is XX hours" is set to at least "24".

For each policy, if "Minimum password age is XX hours" is not set to at least "24", this is a finding.

Fix Text

From the Admin Console:
1. Select Security >> Authenticators.
2. Click the "Actions" button next to the "Password" row and select "Edit".
3. For each listed policy:
    - Click "Edit".
    - Set "Minimum password age is XX hours" to at least "24".