Password policy remembers 24 previous passwords

​

What this check verifies

OCI Identity Domains password policies are evaluated for password reuse prevention via password history (num_passwords_in_history >= 24). System-managed policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded. Legacy IAM lacks password history.

​

Risk

Without password history, users can reuse old passwords. Compromised credentials remain valid after resets, enabling account takeover, unauthorized changes, and lateral movement, degrading confidentiality and integrity and weakening recovery from password-related incidents.

​

Recommendation

Enforce password history in Identity Domains with num_passwords_in_history >= 24. Pair with min_password_age to prevent rapid cycling, and maintain strong complexity and expiration rules. If using legacy IAM, migrate to Identity Domains. Complement with MFA for defense in depth.

​

Remediation

Dashboard steps

1. Sign in to the OCI Console
2. Go to Identity & Security > Domains and select <identity_domain_name>
3. Open Security > Password policies
4. Edit the affected policy (e.g., Default Password Policy)
5. Set “Number of passwords in history” (Remember previous passwords) to 24
6. Click Save
7. Repeat for any other password policies in the domain

​

References

• https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm

​

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_password_policy_prevents_reuse. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Oracle Cloud (OCI) checks