M0927 Password Policies

Set and enforce secure password policies for accounts.

Techniques Addressed by Mitigation

Domain	ID	Name	Use
ics	T0892	Change Credential	Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment.¹
ics	T0812	Default Credentials	Review vendor documents and security alerts for potentially unknown or overlooked default credentials within existing devices

ics	T0822	External Remote Services	Set and enforce secure password policies for accounts.

ics	T0886	Remote Services	Enforce strong password requirements to prevent password brute force methods for lateral movement.

ics	T0859	Valid Accounts	Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. ¹