Next® helps you keep good password hygiene

COVID-19 though re-taught us the value of good hand hygiene. Way before COVID-19, we also knew the value of good password hygiene.

Now, Next® will help you observe that for your local users. 

We strongly recommend that you manage your users in a shared identity repository such as Azure AD and others. These identity repositories have implemented all the security features you could ever wish for - for example Multi-Factor Authentication using SMS, hardware tokens, software tokens, a mobile app, or even voice calls. 

Implementing Next® Enterprise Single Sign-On, allows you to benefit from all of this, in a seamless manner.

This is the ONLY right way to run Next®.

If you need to have users managed locally in Next®, you must have good reasons.

From now on, Next® will use the new built-in user groups to notify you if any these local user profiles have identical user names and passwords. That is, as user with the name Test, should not have the password Test. Equally, the user Admin, cannot be allowed to have the password Admin. If Next® finds a user with similar username and password, everyone in the group Next® Security Council will get a notification.


Your Next® has a severe security issue


Hi Adria Leon

Going through your Next®, we found 2 local user profiles with what appears to be inappropriate passwords. 
This is a serious security issue, and may jeopardize the integrity of your Next®.  

Please contact your IT Operations staff to correct this as soon as possible.

ADMIN   System Administrator
TEST       Test user


You receive this automatic notification by email, because of your Notification settings in Next®.

Best wishes

Your Next® Helpdesk team


For the techies

This notification service cannot read the actual passwords. Instead it creates a hash of the User ID, and compares this generated hash value with that of the password. If the two are the same, the user will be listed in this notification. There is a minimal theoretical risk that a user profile is flagged for inappropriate password, even if the password is in fact different from the User ID. If by any chance you encounter this, we ask for your pardon. Just choose a new password and the matter is settled. 

Be aware that when you install a brand new Next® it comes with a standard user called Admin and the password admin. The first time you sign in using this user, you will be required to change the password (force new password is set). If you do not sign in and change the password, your Next® Security Council will be notified.   

The Notification service - Severe security issues - is mandatory for members of the Next® Security Council. The configuration is owned by Nextway, and cannot be modified or disabled.   

Future enhancements

Over time we will deliver new Notification services that use the new built-in user groups to notify the right people about relevant issues in  Next®.  

Commercial terms and conditions

This new feature is available at no additional cost, to all users with license and active service plan for Next ®.

Disclaimer

Despite our best efforts, we may be forced to change both content and expected delivery of future product updates without notice.  


Details

Title:

Next® helps you keep good password hygiene 

Type:

New feature

Status:

Released

Release time:

January 2022

Affected products:

Next® Contracts
Next® Emails
Next® Enterprise Archive
Next® Invoices
Next® Mailroom

Audience:

Next® admins
Next® users
Next® specialists
Next® 
architects
Next® operational specialists

Classification:

Public

Responsible product manager:

Kim Hellum

Updated:

06.01.2022

By:

Kim Hellum