Everyone has been locked out of an account because they couldn’t remember their password, got it wrong, or it expired. In a personal context, it’s a frustrating experience. In a professional situation, it can become expensive.
In an IBM i environment, some password resets are routine, others are actually a matter of account recovery instead of a simple reset, and some happen during high-risk or even emergency situations. Your team needs a plan and process for each of those scenarios.
Having a plan in place reduces costs, decreases down time, and lowers risks.
Routine password changes
The simplest and most common password reset is scheduled. Most of the time, it happens when the system prompts the user to change their password. It’s part of the normal workflow, and the user knows their current password.
Routine, scheduled, prompted password changes improve security, reduce the number of emergency tickets, and are generally a best practice.
Password policies
Having a password policy that encompasses all of the password requirements for both internal and external stakeholders provides a necessary layer of security. The password policy should include requirements for:
- minimum password length
- how frequently the password must be changed
- whether digits, uppercase or lowercase, and special characters should be used
- whether or not passwords can be reused
- how different a new password must be compared to the previous one
Depending on the size of the organization, regulatory requirements, legal considerations, and other factors, the stakeholders involved in determining password requirements may vary. Having a single policy that encompasses all of those different parties simplifies the process for everyone.
IBM i offers password controls, usually configured as system values, which can be modified using IBM i or 5250 commands.
Some useful commands include:
- Work with System Values (WRKSYSVAL), along with *QPWD or *SEC, as in WRKSYSVAL SYSVAL(QPWD*) or WRKSYSVAL SYSVAL(*SEC)
- Change system Value (CHGSYSVAL)
Another option is to set password controls in Navigator for IBM i through the Configuration and Service->System Values: Password path.
To configure groups of controls together, you can add literals to the Password Rules system value, which is QPWDRULES. This activates multiple password controls at once, so that you can see most password controls on one screen.
Prompts
The sign-on display and the prompts that let users know their passwords are going to expire and should be changed, or that they have expired and must be changed, can be modified. Changing these prompts can support branding or security, reduce risk, use clearer language or terminology, or support long passwords or passphrases. The prompts, or the reasoning for changing them, can be part of the organization’s overall password policy.
Authentication
In most cases the balance between security and user experience when it comes to passwords is tricky. Users become frustrated with long lists of password rules involving upper- and lowercase letters, numerals, and special characters, as well as with being required to change their passwords at frequent intervals. The US Federal zero trust architecture strategy (ZTA) and the National Institute of Standards and Technology (NIST) have addressed that frustration by requiring agencies to remove password policies that require special characters, removing regular password rotation, and excessively long or complex memorialized secrets.
The idea is that passwords will become less complicated and easier for users to remember over time, and that multi-factor authentication (MFA) and longer password lengths will compensate for weaknesses. MFA requires two forms of identification before users can access a protected system, reducing the risk of hackers gaining access with stolen or guessed passwords. Phishing-resistant MFA also eliminates shared secrets like PINs, API keys, passphrases, or other forms of hints to help users remember passwords.
IBM i system values can be aligned with the NIST recommendations, but it’s more difficult to implement MFA. Meeting those guidelines requires a third party solution, such as SEA’s iSecurity Password Reset. Similarly, routine password changes are fairly straightforward, but more difficult situations arise when account recovery is necessary.
Account recovery
What happens when a password change gets more complicated? Perhaps someone has forgotten their password and gets locked out of their account? IBM i doesn’t have a self-service password reset option, so without a third party vendor, the only choice is to contact IT support, which can become time consuming and expensive.
Forgotten passwords
Perhaps an employee has an extended leave of absence, or they switch departments for some time and don’t need their password. All sorts of situations can lead to a forgotten password, but the result is the same: the user can’t get back in.
Expired passwords
Passwords expire for many of the same reasons they are forgotten. Maybe an employee prefers to wait until the last possible moment to follow the prompts to change their password, but then is out sick and it expires.
Disabled profiles
After too many attempts to login, a person’s profile may be disabled. This is good protection against hackers trying to guess at passwords, but creates a problem when an employee’s profile is disabled.
Calling the help desk
Each of these situations, without a vendor for self-service password resetting, requires calling the IBM i help desk. The help desk staff are generally helpful, but the down time and lost productivity aren’t ideal.
Some other risks associated with forgotten or expired passwords and disabled profiles include inconsistency in work quality, poor documentation, and lost productivity. Depending on the business, it’s also possible for customer service to suffer because employees can’t help customers while they’re locked out of the system.
A self-service password reset (SSPR) option from a third party vendor can resolve the issues associated with forgotten and expired passwords and prevent the risks associated with a disabled account. SEA offers an SSPR called iSecurity Password Reset. It’s an automated system, available 24/7, every day of the year, satisfies MFA requirements, can be either self-guided or assisted, and the identification policies are customizable to fit your needs.
In emergencies
Disaster recovery involves much more than password resets, but in emergency situations, access is necessary for business to continue and for security reasons. Here are few password-related disaster recovery considerations:
- System recovery
- Compromised credentials
- Unavailable admin
- Recovery tools/processes documentation
- Audit trails
Password recovery may be necessary in normal day-to-day business as well as during unexpected situations. How much control the user has and the risks associated with recovery are crucial points of consideration.
Having an SSPR option provides potential cost savings through reduced calls to the help desk and preventing productivity loss, improves security, and can be tailored to meet your company’s unique needs. Contact us at SEA for any further questions.
