Dumb idea

But this is just anal. 8-10 characters minimum with three non alpha (capitals included) characters should be more than sufficient to change on a 4 or 6 week basis.

Users complain enough about that.

The company I am at right now (contract) is in a merger and the primary company has a 30 day policy on passwords, at least 8 characters with two numbers somewhere in the middle but not together, and it remembers the last 16 passwords so you can't rotate them. The acquired company had a 90 day policy and your passwords could be pretty much whatever as long as they contained 1 number and were at least 6 characters.

... would be to ban the use of PostIt notes in your office, becuase I am sure that everyone in your company will be sticking their passwords to their monitors. All joking aside, that is the harvest you reap from a bad policy like that (I know that you didn't write it, but you're the one stuck cleaning up the mess). Show the "powers that be" some numbers about how password policies like that make your business LESS secure and cost them $$$ (constan calls to Help Desk for password reset) and you'll hopefully be able to make some changes, plus make your value to the company clear.

J.Ja

Passwords have become far too prevelant. I needed to create a password just to post this reply. IT workers routinely have to deal with half a dozen passwords or more, sometimes with varying requirements. Who can remember the dozens or so passwords in the first place? Then we have to deal with changing our passwords. Ultimately, password enforcement leads people into doing whatever they can to simplify their lives which means either writing down passwords, or making all passwords the same, both of which completely defeat the purpose of the password to begin with.

The concept of one password is a good concept. I'm not sure it will ever truly work unless we get personal encryption keys, but then we need to worry about losing, replacing, or dealing with the personal infringement of having them surgically attached to us like dog licenses are placed under their skin.

Passwords are being used as a means of identification. The only thing worse than making us remember so many passwords, is the other stupid idea, using phone numbers to identify people.

it will not run.

You need to explain to these quite obviously thought challenged people the short-comings of frequent changes of passwords. There are many write ups all over the net that talk about what the end user will do in order to remember their passwords.

Also, explain that they had better put another person full time on password reset duty, as they are going to be swamped. To protest this draconic rule, there are some that don't even try to remember their password for more than a few days.

I do not envy you. You have been put in a horrible position.

Support> "Welcome to support, how can I help you?"
User > " I cant log in"
Support> " Why cant you log in"
User > " I forgot my password"
Support> " well request a passwors change"
User > " thats what I want you to do"
Support> " you have to request a change through the web interface"
User > " How do I do that"
Support> " Just go to the Intranet and click New Passwword Request"
User > " How do I do that if I cant log in?"

We do something similar and it isn't that hard. You just have to explain to people that they have to be a bit more creative. The passwords can still be easy to remember.
burger2go4bi!! (burger to go for bill)
jadei$gr33nt00 (jade is green too)
....or whatever combo you want with symbol and number substitutions. And they have another 30 days to think up a new one that's long but easy. You can include common words because they aren't a singular password. Even something simple like 'rust8steel' is pretty strong within a 30 day window. So is "chocolatemakesmehappysoismile"

You are right on, unless you work at NASA or the NSA or something. In the end, remember that it's probably better to work at a company that overvalues security than one that undervalues it! :)

Ff security needs are so tight that you need 14 character strong pw on a 30 day rotation then it would seem like biometrics would be a consideration - ie, fingerprint readers.

When people lock themselves out, be sure you document how you'll reset passwords. If the company is that concerned, then another concern would be that User A calls in pretending to be User B and asks to have the password reset.

is stupid. People are people and all this will do is encourage them to write it dwon, or use something that can be easily found in the personnel jacket, or be constantly ringing the help desk for resets.

Some years back I worked on a military base and password policy changed from 6 monthly to monthly, result was that 90% of the pass wards became easily findable abusive phrases directed at the policy maker - bet you could guess what they were :p

I know of one company did a similar thing, and within a few months everyone's password was changing every 28 days regular as clock work. I laughed at the policy maker and showed them that all the people were doig was using the current astrological sign as their password, sure many used alpha- numeric replacements, but hey there are just so many of those; you know Aquar1us, Sc0rp10 type thing.

With 14 characters you can get really imaginative like - 1T_1s_f0k_w1ts and similar type phrases, you watch they'll happen. And the next months will be I7_i5_fuk_wi75

Requiring password resets is a good security policy - but one that breaks down quickly if applied without considering the human factors. Setting the interval to 35 days would barely increase the risk associated with password sharing - but make it does make it possible for someone to mark their calendars on, say the 1st of the month and take care of this.

Being consistent with the reset policy is also something that few enterprises seem capable of. Single sign-on, biometrics are even better (and more secure) - Implantable RF-ID tags anyone?

Duff Bailey, Kensico Group, LLC

We use RSA SecurID tokens and most of the users prefer that over simple passwords once they have used the system. One-time use is literal, if you authenticate you have to wait for the code to change to log in again - which is essentially a new password.

There are a very select few that are dead set against it, not sure why but it really is a much better authentication method IMO.

Password policy is a must for almost any business nowadays and almost all (in my experience) have similar policies in place even to the point of a 30 day password expiry especially those that deal with sensitive data. The firm I work for has an almost identical policy to the one you're describing, which whilst it ensures that a record of your movements can be traced by big bro it does also protect you as an employee. The point I'm trying to make is that there are ways around having to think up a new passwaord each month by setting a password with numbers at the end or in the middle or anywhere, which each month are incremented. The main body of the password remains the same and also continues to meet your firms password policy. This also avoids having to write down the password and/or forgetting it.
Unfortunately, I have to change 4 different passwords each month but, have managed to get them pretty much in sync' and committed to memory.

If you need a password email me - one off special. 24 hour turnaround (this will allow for the time difference between receiving and thinking - I'm also in the UK).

I always found it fun to use Post-it notes on all PC's with full user names and passwords.

I agree that a 14 character password is getting a bit stringent but the argument people make that having strong password policies is negated by people using other methods to record passwords and making them simpler because of complexity to remember is a bit of a fallacy, they do it anyway no matter what the policy is. I currently work for an organisation that has no password policy outside of the fact that you need one :) and people are still writing passwords down on post-its and making them simple eg: name of their cat but the organisation is now looking at bringing in a 90-day change policy for regular staff and 30-day policy for higher security users which is attracting the same sort of negativity. As far as I can see it is the only way of ensuring a password that may have made it in to the wild has a half-life of 90 days. At the moment, there is none.

In my opinion there are better security methods than using user generated passwords these days (SecureID, biometric, token based) and these I am hoping will get explored further as a remedy to the password security vs usage dilemna.

A electronic token, it only works if your close to the computer. If you get up and walk away your computer locks and will not unlock untill you are close again. But you still need a password to use the computer.
I can see some one using a icebox magnet to keep it close to the computer :)

is for each memebr of staff to have a special password calculator with a fancy algorhythm in it, the think is preloaded with the program and time synced by wrieless on a regular basis. The user enters their logon ID and stores it, and they also enter their calculator password (which they change as they wish). After that everytime they logon they access their calculator and see what the fancy password for this 5 minute time slice is and enter that. The domain computer runs the ID and time through the same program and compares the answers. The device is waifer thin about 3" x 4" and goes in the same plastic holder as the staff photo ID which they we wear around their neck and is the same size.

oops, instant access.

We had a stupid system that doesn't let you change your password into any password that is the same as the three last passwords to keep your password change it 3 times into different passwords and after that change it to your old one that always worked for me.

You must be able to maintain your Network Password....oh yeah, it must be 256 characters long and include exactly 9 special characters, 9 numbers....

That said, a very brief background: My company is a Nursing home. We have to adhere to HIPPA regulations. We force password changes every 90-ish days. You can't repeat any of the last 24 passwords, must be at least 6 characters long, and have one special character and a number.

Not too hard, right?

So what is your company, and why the immensely inconvenient change?

And if I find Post-It notes, I rip them up. If the user is there, even better. We DO NOT and CAN NOT tolerate password sharing, and the sheer stupidity of using Post-It Notes, or other little tricks, infuriates me.

2600 mag had an article a couple issues ago on generating phonetic passwords. that is, a completely random jumble of letters that can be pronounced. the author provided a php script that i use often, it works great. you can customize it for your organization by adding numerals where you want from any range you want. you could even use a subset of your users' social security number if you have it in a database. unfortunately 2600.com hasn't posted it, so i'll just c/p it here for you. have fun

And a usage example: include ("Phonic64.php");
$password = phonic_password($salt);
// where salt is some random (or not) string

you will get a different result each time you run the function.

We also have the 35 day password changeout.. have found though a very quick and easy way to remember the password and works well.. all you need do is change the number you have entered and will be recognised as new password... only have to remember the main body of one entered.. quick easy and painless for us lower echelons of a computer network

This is one of the areas where security fails to take into account ROI. Password changes impair productivity if done too often, or if the required passwords are too complex to remember.

The crucial question NOBODY seems to ask is this: How often are systems compromised because the passwords are not changed often enough? I know reliable data like this is hard to find, but in my experience, compromises are far and away caused by flawed software (buffer overflows and the like), misconfiguration (no password or default passwords), etc.

.

Seems to be the best way for security log on; so we all need to give a bit of our selfs for a secure network. We stop at a protal put our hands into a scanner and a needal inserts it self into our fingers. This will identify us to the company and let use in.

I know of a company that has an even dumber variation: require 30 day password change for Network password = Windows password, but change the rules for what is an acceptable password each time. Better yet, require different rules for the Oracle password, which also has to be changed every 30 days:-(

A password length of 14 is almost enough to eliminate the weak Lan Manager passwords that can be cracked in minutes.

Instead of idioticly complicated passwords, use a passphrase. Something like "My company is great, and uses long passwords." meets all the requirements that you specified and it's not to hard to remember. It also meet a requirement that you don't (and should) have to avoid the lanman hash vulnerability.

How much encryption is currently considered suficient to protect content (think password-manager software)? Can the recurring password-change problem be overcome by such software, or are there other security issues with this approach?

Well they could always implement some password vault software like my company has, in which we can keep all the various user names and PW's that we have to use. The software encrypts the data and so the user has only one user name and PW which they can remember.

Password policies should be evidence-based.

Is the system stand-alone, or internet linked? Long, complex, frequently changing passwords aren't that necessary if you have 24/7 multiple security guards with computer nodes in locked windowless rooms in locked buildings behind razor-wire fences with intrusion detection and hidden claymore mines.

How critical is the information on the systems?
If the data or system isn't a critical success factor for your organization, then strict security rules aren't necessary. Of course that begs the question of why you have a computer system in the first place.

Does the value of the information on the system decrease with time? If so, set up your security so that it's not impossible to break into, just not possible to break into before the information is useless to the theives.

What are the costs to the organization if the system is compromised? If it means that terrorists can spot times to blow up a nuclear power station without getting caught, then you need very secure password policies (along with other authentication measures). If it means that someone can walk off with patient health information, then it could cost the organization $100 to $25,000 to $50,000 or more. Then you have to balance the annual costs of resetting passwords with the cost if the information is improperly accessed.

Put it in dollars and cents to the policy makers. At least that way you have a REASON for the policy, and not some knee-jerk idea pulled out of the fat man's buttocks.

Has anyone heard of a breach that was in fact due to password guessing? This seems to get all the attention, but all the attacks that I am aware of were social engineering based, and as such, password strength doesn't matter one iota.

Some years ago I recall seeing a study from either a major vendor (maybe IBM?) or one of the big IT consulting shops that discussed in depth the effect on security of overly stringent password policies. It addressed many of the topics in this discussion, including the increased temptation to write down passwords when they have to be changed too often and the repeat restriction is too high.

Has anyone else out there seen that study or have a link to something comparable that is available to help justify policies that have the right balance?

Actually, I put together a spreadsheet to help evaluate password risk, and the effects of various changes (max age, min length, lockout threshold, lockout duration.

I also tried to factor in the basic social engineering factor the the majority of passwords are going to be a dictionary word(or words) of appropriate length.with our without complexity. I am sure there are areaa where it could be improved to provide more accurate results.

Anyway, playing around with the numbers, if you account for the above mentioned social engineering factor, is only better than an all-lowercase password of same length, by a factor of 10. Decreasing max age from 90 to 30 days is only a single order of magnitude as well. If you really want to Strengthen your passwords. Increasing the length is what really helps. (ie going from 8 to 10 characters is roughly 3 orders of magnitude stronger).

It certainly sounds like someone is a living example of "a little
information is a dangerous thing".

First ... if you need 14 characters, call it a "pass-phrase" rather
than "pass-word".

Nothing wrong with a 14-character pass-phrase, with at least
one:
- LC
- UC
- SC
- number
Changing it every 30 days is a horrid idea. 90 days, maybe, a
year, certainly, 30 days? A self-defeating joke. Strong passwords
- and the ones described above are only moderately strong, but
more easily remembered than randomly generated ones - are an
excellent idea, the strict time limit encourages risky behavior
that compromises the password and does little to make the
systems more secure.

Have they at LEAST thought of denying ROOT/ADMIN access to
all but Sys Admin personnel - and insisted that even the SA's use
Admin accounts only for strict Admin purposes?

Any company that has a 30 day password change policy, will also have a policy that will TERMINATE ANY EMPLOYEE who leaves an unsecured password laying around. Also companies that mandate such a password policy also will have a policy that will prevent you from re-using the password, say for 6 months or more. Most employees in such companies will re-use the same basic password and just change one or two characters in a set pattern.

I have done maintenance on PC and network in a large organisation for a while, and more than 70% of the users that have to change their password every so often are keeping their password written under their keybord on a piece of paper or on a sticker

Was use vary long passwords! I like the idea of people using a string of words, like ilikebigdogsatmyhouse or mysonisbetterthenyours. It is vary hard to crack and is a good way to remember passwords for everyone.

In my organization, we have a NetWare password, Windows/AD, Mainframe, Service Center, Cisco, PeopleSoft, and several others vendor related like AT&T and Verizon Business web pages. All of these have different requirements. Some are six characters and others are eight. Some are case sensitive and others not. Most are good for 45 days but one will not let you change it again for 5 days. Most save the last 8 passwords so you can't repeat one that was used in the past year. One system requires that you change the password every 45 days but you can change it to the same password (in effect not changing it.) One of our oud mainframe systems required changing it every 30 days and could not have two like charters in a row. To solve my problem of remembering what I used in the past year, I store them in my palm device in a program called Smartlist To Go and it automaticly tells me when the password needs to be changed.

To make sure no one hacks the system, accounts are disabled if the wrong password is entered three or six times. I guess the data security folks, feel someone could guess your password in 3 to 6 guesses. Theoretically, I think the odds would be against this happening.