Users forced to change password?

[jasoncrcsd]

So yesterday we had many many calls from users complaining they were forced to reset their passwords. We have them set to expire at 180 days but its unlikely all of these users happen to have all changed their pwd last 180 days ago. Could something have caused this?

[Kim_Nilsson]

First the obligatory comment that you should stop doing that. Nobody should change a proper and not compromised password. Ever.

[jasoncrcsd]

Yes I know I've tried fighting that battle trust me. But I have a boss and... well you all know. I've even sent them the research so they know its not just me saying that.

[Kelly_McMahon]

Not arguing, but curious why a proper and not-compromised account should not change their password?

[MarkLoundy]

Kelly,

Probability math. A strong password is just as likely to be brute-forced five minutes after it’s created as it would be after six months. It’s also why lottery, or other gambling numbers are never “due.”

So why needlessly annoy users? It makes them more resistant to valid security requests.

[Kim_Nilsson]

Because a good password can't be hacked (within reasonable time = hundreds/thousands of years), only leaked (compromised).

That means there is almost no security risk keeping a good password "forever".

Also, when forcing password changes, users keep making their passwords less secure, or have them on a post-it on their desk or directly on the computer. This is what all research shows, and exactly why NIST not only changed their policy, but outright says to avoid forced changes, unless compromised.

[Dave_Burek]

I agree with Kim. But, we run into the same issues with Cyber Insurance and our Financial Auditors requiring it.

[jasoncrcsd]

Yea for us too

[Kim_Nilsson]

That is where you have to put your foot down. They are wrong, and need to be told so, or they will keep recommending/forcing bad practice forever.

[jasoncrcsd]

Now today I have sub accounts prompting and those accontys do not have a psss exp date. Somethign is wrong in Google but they say nothing

[Kim_Nilsson]

That is strange, but afaik, you are so far the only one reporting the issue.

[jasoncrcsd]

Yea it could be. its not really as big an issue as they are making it.

Thanks

[alexgrutza]

I will say that NIST (if you're in the USA) doesn't even recommend password changes anymore in their guidelines and Microsoft hasn't in at least a decade or more. We've gone away from password changes unless we get notified of compromised accounts. Luckily our insurance as far as I'm aware doesn't have a clause around this.

I'd have to agree and also disagree with Kim because if the Insurance is dictating this, we you have a say. We can suggest things, but at the end of the day it's the Insurance that is going to be paying out based on their contract. It could also be that if you don't comply and change passwords X-days, the premiums may go up substantially which organizations (especially edu/nonprofits) cannot afford.

It's hard enough to find a Cyber Insurance provider as EDU is especially targeted. Our previous Cyber Insurer exited the EDU market completely and dropped all schools because Edu caused them to pay out so much money.

[Justin_W]

For what it's worth, our Auditors (not Cyber Security Insurance co) were requiring password changes until I took the time to point out to them that it was a dated practice.

I shared some of the resources on new best practices, and the following year they had removed the requirement.

So it may be worth trying if you hadn't.  

But yeah, I certainly wouldn't count on getting them to change.  

Changing a strong, un-compromised password is bad practice  -and may actually increase odds of bad password habits.  BUT - the reality is that most places/people still don't realize that their password HAS been compromised until it's too late. So I can still see the logic in just taking the oldschool "hammer" approach.