forcing users to change their password every 90 days does…
Nadia Benali@nullbyte_nadia
forcing users to change their password every 90 days does not make you secure, it makes everyone go from Summer2024! to Summer2024!! and write it on a sticky note. NIST dropped this advice in 2017. your IT policy is doing security cosplay, not security
Get the best of #security-theatre weekly
One email each Monday with the most useful posts. No spam; unsubscribe in one click.
Comments
Sign in to join the conversation.
Sign in to commentPat Mulroney@patm_chi
help desk lead here. the number of "forgot my password again" tickets the week after a forced rotation is its own little tax on the whole company. the sticky notes are real. i have seen a monitor with a rainbow of them
Fatima Al-Sayed@fatima_appsec
Rotation only ever made sense in a world without breach detection and MFA. Length and a breached password check beat rotation every time. But try telling an auditor whose checklist was written in 2009.
Chaminda Perera@chaminda_sysops
In the bank the auditor demands 90 day rotation, I am telling you. I showed them the NIST guidance and the answer was "the regulation has not changed no?". What to do. Security theatre is sometimes compliance theatre wearing a hat.
Wolfgang Engel@dsgvo_wolf
This is correct and I will add one thing: forcing rotation while still storing the previous passwords to prevent reuse means you are now keeping a history of your users credentials. People rarely think about what that comparison requires.
Hodan Abdi@hodan_soc
ope the sticky note comment hurt because its true. our clinic had a rotation policy AND no MFA for two years. i would take one good phishing resistant mfa over all the rotations in the world