Oracle EBS password security measure

Signon Password Case :-
This profile option is used to force case sensitivity in user
passwords. This option allows for tighter security, as well as for better
integration with Oracle Internet Directory, because it also allows case
sensitive passwords. Setting this profile on an existing system has no affect
on existing passwords already stored in the system. The case sensitivity will
start to take affect the next time a password value is changed – it is then
that the rule is applied.

Signon Password Custom:-

This profile option is used if you want to define your own
password scheme (validated by custom Java code) in a custom Java class. This
would be used if you have a more advanced and complex password value requirement
that is not supported by the site profiles described in this paper. For
example, your password policy could state that the password value must have a
numeric value, an uppercase value, and a special character. If this were the
case, you would not be able to enforce that password policy with the existing
Oracle E-Business Suite profiles, so you would need to create a custom password
java class and set the profile value to that class name for Signon Password
Custom.

Signon Password Failure Limit:-
By default, there is
no account lockout after a failed number of login attempts. This is just asking
to be hacked! This is recommended setting a failure limit using the Signon
Password Failure Limit profile option. Prior to release 11.5.10,  you needed to implement an alert (periodic),
custom workflow or report to notify security administrators; now the system
‘locks’ the account. Both the FND_UNSUCCESSFUL_LOGINS and ICX.ICX_FAILURES
tables capture failed login attempts from the Personal Home Page (Self Service/Web
Interface), but failed Forms sessions are only logged to
FND_UNSUCCESSFUL_LOGINS.
Signon
Password Hard to Guess –

The Signon Password Hard to
Guess profile option sets internal rules for verifying passwords to ensure that
they will be “hard to guess.” Oracle defines a password as
hard-to-guess if it follows these rules:
This profile option is used to force case sensitivity in user
passwords. This option allows for tighter security, as well as for better
integration with Oracle Internet Directory, because it also allows case
sensitive passwords. Setting this profile on an existing system has no affect
on existing passwords already stored in the system. The case sensitivity will
start to take affect the next time a password value is changed – it is then
that the rule is applied.
Signon Password Custom:-

This profile option is used if you want to define your own
password scheme (validated by custom Java code) in a custom Java class. This
would be used if you have a more advanced and complex password value requirement
that is not supported by the site profiles described in this paper. For
example, your password policy could state that the password value must have a
numeric value, an uppercase value, and a special character. If this were the
case, you would not be able to enforce that password policy with the existing
Oracle E-Business Suite profiles, so you would need to create a custom password
java class and set the profile value to that class name for Signon Password
Custom.

Signon Password Failure Limit:-
By default, there is
no account lockout after a failed number of login attempts. This is just asking
to be hacked! This is recommended setting a failure limit using the Signon
Password Failure Limit profile option. Prior to release 11.5.10,  you needed to implement an alert (periodic),
custom workflow or report to notify security administrators; now the system
‘locks’ the account. Both the FND_UNSUCCESSFUL_LOGINS and ICX.ICX_FAILURES
tables capture failed login attempts from the Personal Home Page (Self Service/Web
Interface), but failed Forms sessions are only logged to
FND_UNSUCCESSFUL_LOGINS.
Signon
Password Hard to Guess –

The Signon Password Hard to
Guess profile option sets internal rules for verifying passwords to ensure that
they will be “hard to guess.” Oracle defines a password as
hard-to-guess if it follows these rules:
Signon Password Custom:-
This profile option is used if you want to define your own
password scheme (validated by custom Java code) in a custom Java class. This
would be used if you have a more advanced and complex password value requirement
that is not supported by the site profiles described in this paper. For
example, your password policy could state that the password value must have a
numeric value, an uppercase value, and a special character. If this were the
case, you would not be able to enforce that password policy with the existing
Oracle E-Business Suite profiles, so you would need to create a custom password
java class and set the profile value to that class name for Signon Password
Custom.

Signon Password Failure Limit:-
By default, there is
no account lockout after a failed number of login attempts. This is just asking
to be hacked! This is recommended setting a failure limit using the Signon
Password Failure Limit profile option. Prior to release 11.5.10,  you needed to implement an alert (periodic),
custom workflow or report to notify security administrators; now the system
‘locks’ the account. Both the FND_UNSUCCESSFUL_LOGINS and ICX.ICX_FAILURES
tables capture failed login attempts from the Personal Home Page (Self Service/Web
Interface), but failed Forms sessions are only logged to
FND_UNSUCCESSFUL_LOGINS.
Signon
Password Hard to Guess –

The Signon Password Hard to
Guess profile option sets internal rules for verifying passwords to ensure that
they will be “hard to guess.” Oracle defines a password as
hard-to-guess if it follows these rules:
This profile option is used if you want to define your own
password scheme (validated by custom Java code) in a custom Java class. This
would be used if you have a more advanced and complex password value requirement
that is not supported by the site profiles described in this paper. For
example, your password policy could state that the password value must have a
numeric value, an uppercase value, and a special character. If this were the
case, you would not be able to enforce that password policy with the existing
Oracle E-Business Suite profiles, so you would need to create a custom password
java class and set the profile value to that class name for Signon Password
Custom.
Signon Password Failure Limit:-
By default, there is
no account lockout after a failed number of login attempts. This is just asking
to be hacked! This is recommended setting a failure limit using the Signon
Password Failure Limit profile option. Prior to release 11.5.10,  you needed to implement an alert (periodic),
custom workflow or report to notify security administrators; now the system
‘locks’ the account. Both the FND_UNSUCCESSFUL_LOGINS and ICX.ICX_FAILURES
tables capture failed login attempts from the Personal Home Page (Self Service/Web
Interface), but failed Forms sessions are only logged to
FND_UNSUCCESSFUL_LOGINS.
Signon
Password Hard to Guess –

The Signon Password Hard to
Guess profile option sets internal rules for verifying passwords to ensure that
they will be “hard to guess.” Oracle defines a password as
hard-to-guess if it follows these rules:
Signon Password Failure Limit:-
By default, there is
no account lockout after a failed number of login attempts. This is just asking
to be hacked! This is recommended setting a failure limit using the Signon
Password Failure Limit profile option. Prior to release 11.5.10,  you needed to implement an alert (periodic),
custom workflow or report to notify security administrators; now the system
‘locks’ the account. Both the FND_UNSUCCESSFUL_LOGINS and ICX.ICX_FAILURES
tables capture failed login attempts from the Personal Home Page (Self Service/Web
Interface), but failed Forms sessions are only logged to
FND_UNSUCCESSFUL_LOGINS.
Signon
Password Hard to Guess –
The Signon Password Hard to
Guess profile option sets internal rules for verifying passwords to ensure that
they will be “hard to guess.” Oracle defines a password as
hard-to-guess if it follows these rules:
The Signon Password Hard to
Guess profile option sets internal rules for verifying passwords to ensure that
they will be “hard to guess.” Oracle defines a password as
hard-to-guess if it follows these rules:
            o The password does not
contain repeating characters.
            o The password does not
contain the username.
Signon
Password Length:-
Signon
Password Length sets the minimum length of an Oracle Applications password
value. The default length is 5 and I recommended 8.
Signon
Password Length:-
Signon
Password Length sets the minimum length of an Oracle Applications password
value. The default length is 5 and I recommended 8.
Signon
Password No Reuse :-
This profile option is set to the number of days that must
pass before a user is allowed to reuse a password.
This profile option is set to the number of days that must
pass before a user is allowed to reuse a password.
To
change APPS/APPLSYS password, we need to give mode as SYSTEM

Password change for APPS / GL / AR :-