Loading…
8
Warning: That 90 day password rule is making your accounts LESS safe, and NIST said so in 2017
I keep seeing people at work say you have to change your password every 90 days, but I looked it up and NIST Special Publication 800-63B flat out says to stop doing that. The reason is people just do Stuff1, Stuff2, Stuff3, and the bad guys know that pattern, so it makes things worse. I switched my team to long passphrases and no forced resets, and our IT guy in Columbus says break ins dropped. Has anyone else had pushback from management on this, or am I the only one fighting it?
1 comments
Log in to join the discussion
Log In1 Comment
elliot549d ago
Get that NIST updated their stance, but dropping forced resets without other controls can backfire. Long passphrases are great until people reuse the same one everywhere. Our place kept the 90 day rule but added MFA and that did way more for us than switching to passphrases alone.
7