GE Reason H49, Technical Manual

Page: 108 / 158

Technical Manual GE Reason H49
108 H49/EN M/C22
8.1.5 Password Management
One of the fundamental principles of cyber security consists in combining a user ID
with a password.
For Reason H49, password policy is implemented in compliance with IEEE 1686
recommendations.
Password Complexity
The password policy is implemented for all local users.
This action is done in the Security > User Accounts page.
The security administrator can increment here the user’s account password
complexity by defining restrictions according to the NERC CIP and IEEE 1686-2013
standards:
•
Minimum number of characters:

9 with 4 character types: Uppercase, Lowercase, Numeric and special non-
alphanumeric {such as @,!,#,{, etc.} !
Note:
password complexity can be disabled to accommodate customers that do not require complex passwords.
Password Expiration Period
The security administrator can force users to change regularly their password. He/she
can set the password lifetime after which it expires.
Consecutive Login Attempts
The security administrator can set the number of consecutive login attempts before
locking a user account and the locking period.
Inactivity Period
The security administrator can set the inactivity period before disconnecting a user.
This avoids leaving the device accidentally open to access by authorized persons.
Thus, when the user does not perform an action within the pre-defined interval,
he/she will automatically log off.
Locking Period
After a fixed number of login attempts, the user account is locked out. The system
tags it with the icon.
The user will have to wait until the end of the security time (see Locking period in
section Security Settings).