Calculating the security score for password reset process

  • Release version: Washingtondc
  • Updated January 30, 2025
  • 1 minute to read

    • The security score of the password reset process is a critical metric for the password reset administrators to assess the strength and configuration of the password reset process.

    Password reset calculation

    The password reset process score provides a quantitative measure of how well the process is configured to protect against unauthorized access and confirm that only legitimate users can reset their passwords. The score is based on the following categories:
    • Identification score (Max: 20 points)
    • Verification score (Max: 40 points)
    • Configuration score (Max: 20 points)
    • Password policy score (Max: 20 points)

    Identification score

    To increase your identification score, you must enable multiple identification methods. If you’re currently using only one method, such as a username, adding another method like an email can increase your score by approximately five points. Additionally, enabling CAPTCHA adds 10 points to your score and help to prevent the bots from exploiting the password reset flow.

    Verification score

    To achieve a high score, you must use at least two verification methods with medium or high security levels. Each method adds up to 15 points (medium) or 25 points (high).

    For the custom verification types, you must assign the security level. By default the custom verification is set as low.

    Configuration score

    To optimize your score, enable either the Email/SMS Password Reset URL or auto-generate passwords. If neither is enabled, the score is set at 10 points. Enabling either of these options fetches 20 points.

    Password Policy Score

    To maximize your Password Policy Score, enable the Password Policy on the Credential Store if it isn’t active. Implement the Enforce History Policy to prevent users from reusing their last five passwords as defined in the password_history_limit property. Use a High strength password policy and enable the following settings:

    Send password reset process security score notification is a weekly job that send reminders to the password admin about the score and recommendations to improve the score. An email notification is sent to the Process Owners of all the active processes if Enable security score notification option is selected in Password Reset Process form.