We need to have best practices for user accounts and authentication policies. The best practices in this realm are as follows:
- Multi-factor authentication: We should enable multi-factor authentication, using products such as SecureID, or even some kind of a Time-based One Time Password (TOTP) such as Google Authenticator
- Strong password policies: We should set strong password policies for users in relation to password reuse, force password changes, length of passwords, and so on
- Different privileged and normal accounts: We should have different accounts for administrative users for performing administrative tasks; we should not provide administrative access to the normal user account that is created for ...