2.3 Best Practices for Self Service Password Reset

Use the following information to help you decide how to configure Self Service Password Reset to get the best results.

2.3.1 Best Practices for Password Policy

To enhance the security of password policies:

  • Use a word list to prevent easily guessable passwords

  • Use a shared word list to prevent organizational password value use from becoming common among many users

  • Do not allow users to configure challenge questions

  • Do not impose complex syntax rules on users; instead, use a specific overall complexity level

  • Use a long list of potential random question challenges that are unlikely to have similar answers among different users

For more information, see Configuring a Profile for a Password Policy in the Self Service Password Reset 4.3 Administration Guide.

2.3.2 Best Practices for Self Service Password Reset Security

To enhance the security of Self Service Password Reset, Micro Focus recommends that you do the following:

  • Enable the CAPTCHA support.

  • Configure HTTPS for end-to-end security.

  • Configure LDAPS for end-to-end security.

  • Use a strong encryption protocol for formatted hashed stored responses.

  • Configure Self Service Password Reset to see source network addresses for complete audit records to be maintained.

For more information, see Configuring Security Settings in the Self Service Password Reset 4.3 Administration Guide.