The IT Auditor recommended us to update the the following password security settings in our SAP database (Oracle 11g):
PROFILE: SAPUPROF & DEFAULT
All of them are assigned with NULL or UNLIMITED or DEFAULT value.
The auditor recommended to update the configuration based on recommended practice below:
- FAILED_LOGIN_ATTEMPTS between 3 to 5
- PASSWORD_LIFE_TIME 90 days or less
- PASSWORD_REUSE_TIME 365 days or higher
- PASSWORD_REUSE_MAX 4 or higher
- PASSWORD_VERIFY_FUNCTION ENABLED
- PASSWORD_LOCK_TIME 5 days or higher
My question is:
Is there any negative impact to the SAP server functionality if we upgrade the password security based on the recommended practice?