Password Policy
This document defines the strict cryptographic and administrative parameters for password management across anDREa B.V. (anDREa) systems and the myDRE platform. This policy aligns with ISO 27001:2023 (A.08.05 - Secure Authentication), GDPR (Articles 24-1, 32), and NIS 2 security controls, governing all employees, temporary staff, contractors, and third parties.
This framework undergoes mandatory evaluation and revision at least annually, or immediately following significant updates to our identity infrastructure.
1. Authentication Baseline: Mandatory MFA & Passkeys
Passwords alone are insufficient to guarantee platform integrity.
- MFA Requirement: All platform logins universally require Multi-Factor Authentication (MFA) in addition to a valid password.
- Modern Credentials: The adoption of Passkeys and FIDO2-compliant hardware security keys (e.g., YubiKeys) is highly encouraged for all users and remains strictly mandatory for core anDREa personnel.
2. Platform-Specific Password Configurations
A. myDRE Ecosystem (Microsoft Entra ID)
Platform authentication configurations leverage Microsoft’s security baselines and heuristics to intercept malicious authentication attempts.
| Configuration Item | Enforced Technical Setting | Behavioral Context & Governance |
|---|---|---|
| Minimum Length | 8 characters (Maximum 256 characters) | System-enforced baseline. |
| Complexity Rules | 3 out of 4 character classes required:• Uppercase letters ($A-Z$)• Lowercase letters ($a-z$)• Numbers ($0-9$)• Special symbols/punctuation | System-enforced baseline. |
| Prohibited Elements | Unicode characters are completely blocked. | Prevents homograph or encoding exploits. |
| Lockout Threshold | 10 consecutive failed attempts | Safeguards against automated brute-force attacks. |
| Lockout Duration | 60 seconds | Hard cooling-off period before account re-entry is permitted. |
| Rotation Cadence | Never Expire | Aligned with NIST Special Publication 800-63 (Digital Identity Guidelines) and Password policy recommendation for Microsoft 365 Passwords . Periodic, forced rotation degrades security by driving users to predictable patterns. |
| History Restrictions | Users cannot reuse their current active password during a manual reset sequence. | Enforced system-wide. |
| Active Directory Integration | Enabled on Windows Server Active Directory. | Operational mode is set to Audit to log and evaluate credential health. Password protection on Windows Server Active Directory |
Threat Monitoring: anDREa utilizes Microsoft identity heuristics to continuously evaluate authentication traffic, automatically flagging "Risky Users" and isolating anomalous behavioral indicators.
B. Corporate Office Environment (Google Workspace)
All corporate messaging, file orchestration, and administrative office systems utilize Google Security Recommendations. Passkeys, hardware security tokens, and phishing-resistant configurations are preferred and actively enforced across staff profiles.
3. Universal Requirements for Auxiliary SaaS & External Systems
For any complementary, secondary, or auxiliary system where federated myDRE or Google enterprise authentication is unavailable, users must manually construct passwords conforming to the following parameters:
-
Length & Structure: Enforce a minimum length of 10 or more characters. Credentials must mix uppercase/lowercase alphabetic characters, numeric digits, and special symbols.
-
Random Generation: Passwords must be randomly generated where technically feasible. The deployment of enterprise-approved Password Managers is authorized and strongly advised.
-
Prohibited Patterns: * Avoid character repetition, sequential number/letter blocks, or standard keyboard spatial patterns (e.g., "qwerty").
-
Do not utilize standard dictionary words or simple combinations of weak words.
-
Biographical Dispersal: Passwords must completely avoid personal or publicly identifiable information, including usernames, biographical dates, relative names, pet designations, or historical personal details easily discovered by acquaintances or colleagues.
-
Exfiltration Auditing: Users are encouraged to actively check their personal and secondary email footprints against credential compromise ledgers using trusted public auditing services like Have I Been Pwned.
-
Zero Expiration: In strict compliance with NIST SP 800-63b guidelines, secondary accounts must not undergo mandatory calendar rotation rules unless a specific compromise or threat vector is identified.