KB • Security

1. Use Strong, Unique Passwords

Generate passwords with at least 12 characters, mixing uppercase, lowercase, numbers, and symbols. Store them securely using a password manager.

2. Enable Multi‑Factor Authentication (MFA)

Require a second verification step (e.g., authenticator app, hardware token) for all critical accounts.

3. Keep Software Updated

Apply patches and updates promptly for operating systems, applications, and firmware.

4. Principle of Least Privilege

Grant users only the permissions they need to perform their tasks. Review and revoke excess rights regularly.

5. Secure Configuration Baselines

Adopt hardened configurations for servers, databases, and network devices. Disable unused services and ports.

6. Encrypt Data At Rest & In Transit

Use TLS 1.2+ for network traffic and AES‑256 for stored data. Manage keys using a centralized vault.

7. Regular Backups & Recovery Testing

Perform encrypted backups daily. Test restore procedures quarterly to ensure data integrity.

8. Security Monitoring & Logging

Collect logs from all critical systems, centralize them, and set up alerts for anomalous activity.

9. Conduct Penetration Testing & Vulnerability Scans

Schedule quarterly scans and annual pen tests. Prioritize remediation based on CVSS scores.

10. Employee Security Awareness Training

Run monthly phishing simulations and security workshops to keep staff vigilant.

Sample Bash Script: Enforce Password Complexity

#!/bin/bash
# Ensure password meets policy: 12+ chars, mixed case, digit, symbol

read -s -p "Enter new password: " pwd
echo
if [[ ${#pwd} -lt 12 ]]; then
  echo "Password too short"
  exit 1
fi
if ! [[ $pwd =~ [A-Z] && $pwd =~ [a-z] && $pwd =~ [0-9] && $pwd =~ [^A-Za-z0-9] ]]; then
  echo "Password must include upper, lower, digit, and symbol"
  exit 1
fi
echo "Password meets complexity requirements"
Copy