Security

Ask something
Discussion Locked

How often is too often to enforce password changes

0 helpful
6 replies

by cass.harley 3 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am working on a draft for a password policy for our firm (2 servers, 26 workstations, 10 remote users).

Previously the system had been very lax (I could guess most passwords, if I couldn't guess them I just had to ask someone close by).

Passwords have been changed every 6 months.
I am not wanting to annoy the users too much by changing passwords too frequently.

Is 6 months too long a length of time?

6 replies

by thechas

I recommend that you start with a reality check.

Most users HATE to change their passwords.

Ask yourself, and your managers just how critical your data and network are?

What are the risks if the users do not change passwords often?

If the data is not critical or sensitive, and the repercussions of an unauthorized user getting access are low, it may not be worth the time and effort to force changes.

Remember, the more often you force changes and the more complex the passwords are, the more likely it is that user will keep easy to find written records of their passwords.

Chas

by cass.harley

It is an accounting firm, so I would suggest that if the information was able to get outside the firm, the least that would happen is we would lose a client. The worst is that we could be sued I would imagine.

On that note, I think at the moment, the passwords really only stop other users using their someone elses logon.

Although the risk is minimal, I think that password sharing provides a means for a rogue employee to 'frame' someone.

I have read the sample policy and it does not address the issue of 'how often to change'.
If the password is good, do they need to change it at all?

by thechas

Since it is an accounting firm, some of the data could be very sensitive.

Here are some things you might want to try:

Every 3 to 6 months send out an e-mail to all users.
Ask them to think about their clients security, and their professional integrity.
If there is a chance that their passwords have been shared or compromised, it is in their best interest to change the password.

Users who have access to the widest range of customer files should be required to change passwords on a regular basis.

Chas

by deadly ernest

The comments by Chas are good. From my 30 years working in password access areas I can tell you that the general rule is:

'The more often the change the more likely they are kept on notes' and

'the more often the change the more likely it is in their public personal records'

The most common reason for sharing passwords is because person A forgot their's and needed access whilst the tech people were resetting the account.

Password longevity with immediate password reset and policies with dire results for giving it to someone will greatly reduce password sharing. If it can be reset on the phone then no reason why not to get it done immediately. If not changed oftne no reason why it needs to be written down.

Make sure people know that THEY are responsible for EVERYTHING done under their password, with penalties for bad behaviour. They soon stop sharing.

As Chas said quarterly or biannual reminders to review and consider a password change, and then leave it up to them.

Nothing pisses me off quicker than being TOLD I MUST change my password now; except maybe being told it is only 4 or 6 characters max.

I always recommend that a password should be a minimum of 6 characters, maximum of 12 or 15 characters, must have 1 uppercase character, must have 1 lowercase character, must have 1 numeric character, no blanks within it, not a dictionary word, no family names, no birthdays, and not take up the full field avaialable.

This sounds a lot but it does allow people to make up passwords that are easy to remember from code phrases that are not in theri personal files. Digits can be added by converting an i or l to a 1 and a o to a 0 or an s to 5 or z to 2 etc.

Muddled phrases are very easy to remember, like those old school training phrases.

Possible examples b3achBa11er or gR1dleIr0n or Ha1ryP0tty meet the above, are easy to remember and not readily found in files etc.

by cass.harley

Can I summarise by saying, that if a password is design well, and the user follows the correct protocols to ensure nobody knows there password, then there is no need to ever enforce password changes? Not every 6 months, not every 12 months, not ever?

Except that regular emails should be sent around asking staff to advise if they feel that there password has been compromised, in which case their password should be changed?

by deadly ernest

I thought both Chas and I said that the only regular reminder should be to consider if they felt they needed changing. Not a requirement to change, but to review their individual situation and make a change if they feel it is needed.

I once worked in a secure environment, when the Officer in charge changed the new guy insisted on monthly password changes. That is until I demonstrated to him the stupidity of it. Everyone was to experienced to write it down or use something from their personal files.

We had a program that would check if any passwords matched the password we entered.

Two months into the new regime I had the OIC there whilst I activated this program and then ran checks for common variants of phrases that are usually used to suggest the OIC do certain actions, from the first 4 common variants I got matches for 65% of the account passwords.

The OIC forgot that if something is changing all the time the troops needed soemthing very simple to remember. He changed the policy to allow them to have the same password for their whole 3 year posting provided it met the complex password policy.

This discussion is closed to new replies.