Agencies SHOULD formally share post-incident review reports by emailing them to incidents@ncsc.govt.nz.

Use of MFDs for printing, scanning, and copying purposes SHOULD be centrally logged.

Agencies SHOULD design and implement Zero Trust principles and architecture to strengthen identification management.

Agencies MUST NOT use shared credentials to access administrator or privileged access accounts.

NB: Break Glass accounts are exempt from this control. For further guidance on Break Glass accounts see Emergency accounts (Break Glass accounts section).

Agencies SHOULD assess and determine the risk of centralised access management systems, including SSO, to safely manage integration into systems and when using FIM.

Agencies MUST ensure adequate password policies are implemented and enforced across all systems.

Agencies MUST implement a password policy enforcing at least annual password changes on systems that have not implemented MFA or passwordless authentication.

Agencies MUST implement a password policy enforcing:

• A minimum password length of 16 characters (e.g four words).
• Passwords must be long, strong and unique. This means passwords must be a minimum character length, and are a combination of unique random words, characters or numbers.

NB: no explicit complexity requirements are enforced (e.g. numbers or special characters), however passwords must be unique, or random and may include special characters and numbers to achieve this.

To ensure security of systems are not weakened through authentication mechanisms, at a minimum, agencies MUST:

• apply MFA appropriately (refer to controls in Section 16.7);
• ensure authentication secrets (including passwords) are securely stored;
• remove knowledge-based questions from authentication process (eg, dog’s name, first school etc.);
• new passwords are screened to reduce the likelihood of previously compromised passwords;
• remove hints from authentication process; and
• change passwords when a suspected or known compromise of an account has occurred.

Agencies SHOULD consider the use of location-based factors in the authentication process, (e.g., Users must be at an expected location (city, country, IP address) and provide the correct credentials for the authentication to succeed).

When creating password policies, agencies SHOULD consider implementing annual password changes.

Passwords and other authentication secrets MUST be stored securely including being:

• salted (32 bits or more),
  • salts should be unique to each password and should be randomly generated.
• hashed (HMAC using SHA-2/3), and
• “stretched” (such as PBKDF2 with at least:
  • 600k iterations with internal hash function of HMAC-SHA-256; or
  • 210k iterations with internal hash function of HMAC-SHA-512).

Where passwords are not set by the account holder, agencies MUST use temporary passwords when resetting system user accounts.

Agencies SHOULD NOT use single factor authentication when changing users’ Multi-Factor Authentication details.

Password managers provide no additional security to the sign-in password. Agencies using password managers MUST ensure sign-in passwords adhere to the password security policies used by the organisation.

Agencies using password managers SHOULD consider the use of MFA to access the password manager.

When moving to passwordless authentication, agencies SHOULD carry out a risk assessment and evaluate passwordless authentication models to choose authentication mechanisms and factors that best fit the organisation’s security and authentication requirements.

Agencies MUST ensure authentication methods that are susceptible to replay attacks are disabled.

Agencies SHOULD consider the use of time bound revocation to privileged accounts.

Agencies MUST investigate any indication of compromise or misuse of systems credentials or accounts.

Agencies SHOULD use Zero Trust principles alongside the use of VPN connections to enhance the security posture of the organisation. This should include removing the ability for a standard user to disable the VPN connection.

Agencies should prioritise their log retention requirements based on the risks surrounding their most sensitive systems.

Agencies SHOULD have a monitoring solution implemented that enables detection of incidents as they occur so that appropriate responses can be taken in adequate timeframes.

Agencies SHOULD have systems available for processing system event logs to identify and correlate events which indicate behavioural anomalies or potential security compromise in the systems, in a near real-time manner.

Where an agency has external facing systems, cloud-based services, or is authenticating to third-party services services, they MUST:

• require MFA for all user accounts; and
• implement a secure, multi-factor process to allow entities to reset their standard user credentials.

Agencies MUST implement MFA on all user accounts with remote access to organisational resources.

Agencies SHOULD implement MFA on all user accounts with access to organisational resources.

Where agencies have implemented MFA, they SHOULD implement phishing-resistant MFA on administration accounts.

Agencies SHOULD use phishing-resistant MFA when authenticating users to systems.

EAP-TLS or PEAP-EAP-TLS MUST be used on wireless networks to perform mutual authentication.

Agencies MUST NOT use Wi-Fi Protected Access (WPA) for wireless deployments.

Agencies SHOULD use Wi-Fi Protected Access 3 (WPA3) for wireless deployments with preference given to WPA3-Enterprise 192-bit mode.

Agencies SHOULD formally report information security incidents using the NCSC on-line reporting form.

Any RFID tags of class 3, 4, or 5 MUST NOT be permitted in secure spaces.

RFID readers MUST NOT be permitted in secure spaces.

Class 2 RFID tags SHOULD NOT be permitted in secure spaces.

Agencies MUST implement a password policy enforcing:

• a minimum password length of ten characters, consisting of at least three of the following character sets:
  • lowercase characters (a-z);
  • uppercase characters (A-Z);
  • digits (0-9); and
  • punctuation and special characters.

Agencies SHOULD implement a password policy enforcing either:

• a minimum password length of 16 characters with no complexity requirement; or
• a minimum password length of ten characters, consisting of at least three of the following character sets:
  • lowercase characters (a-z);
  • uppercase characters (A-Z);
  • digits (0-9); and
  • punctuation and special characters.

Agencies MUST:

• ensure that passwords are changed at least every 90 days;
• prevent system users from changing their password more than once a day;
• check passwords for compliance with their password selection policy where the system cannot be configured to enforce complexity requirements; and
• force the system user to change an expired password on initial logon or if reset.

Agencies SHOULD:

• ensure that passwords are changed at least every 90 days;
• prevent system users from changing their password more than once a day;
• check passwords for compliance with their password selection policy where the system cannot be configured to enforce complexity requirements; and
• force the system user to change an expired password on initial logon or if the password is reset.

Agencies SHOULD NOT:

• allow predictable reset passwords;
• reuse passwords when resetting multiple accounts;
• store passwords in the clear on the system;
• allow passwords to be reused within eight password changes; and
• allow system users to use sequential passwords.

Agencies SHOULD:

• lock system user accounts after three failed logon attempts;
• have a system administrator reset locked accounts;
• remove or suspend system user accounts as soon as possible when personnel no longer need access due to changing roles or leaving the agency; and
• remove or suspend inactive accounts after a specified number of days.

Agencies SHOULD configure systems to display the date and time of the system user’s previous login during the login process.

Agencies SHOULD NOT permit the display of last logged on username, credentials or other identifying details.

Agencies SHOULD NOT permit the caching of credentials unless specifically required.

Agencies SHOULD:

• ensure strong change management practices are implemented;
• ensure that the use of privileged accounts is controlled and accountable;
• ensure that system administrators are assigned an individual account for the performance of their administration tasks;
• keep privileged accounts to a minimum; and
• allow the use of privileged accounts for administrative work only.