Security

Ask something
Discussion Locked

Non-expiring passwords.

0 helpful
5 replies

by yuss

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

These are unfortunately unavoidable. My organization needs to set policy for the use and control of non-expiring passwords.
What are your policy recommendations and how do you control them?

5 replies

by james r linn

A non expiring password is better than a password stuck on a yellow sticky.....

I would absolutely refuse to have a shared password, such as a backdoor/super user etc., not expire.

I would enforce the strongest password rules you can, ie at least 8 charecters, and at least one alpha, one numeric and one special charecter. We also ask people not to use whole words.

Once a month we run a cracking program against the passwords, and ask those who have too easy passwords to change them. We actually track our ability to crack passwords from month to month (x% cracked in X hours), as a security efficacy metric.

Hope that helps

James

by prefbid ii

I agree that some non-expiring passwords are unavoidable. However, you need to make them hard to obtain. I would limit them to those areas that are impossible to avoid and try to describe those situations. For example, "Non-expiring passwords areonly allowed for machine-to-machine communication. Such passwords will be assigned by the administrator, will have a minimum of 9 characters, and be completely random. Programmers with knowledge of the password will have their account marked as such and the password will be changed if any of those programmers leave the company." It's good in theory, but I have never seen it work outside the military.

by clearsmashdrop

If you want to force good password then the upper management needs to be behind the decision.

Its amazing how many people resist using passwords more complicated than 1234.

In our organization everyone changes every 45 days. But in the pastsales people were allowed to have Windows98 laptops. No security there, should the laptop get lost or stolen. So, while a half measure seems better than none, Id wish we were allowed to be consistant.

Do you use POP mail for remote people? This causees most of our headaches. Every 45 days the remote people will call us cause they forget where in outlook to change passwords.

by michael mietlicki

Strong passwords equate to having UPPERCASE and lowercase characters and special characters such as &, *, @, _, etc .. set a minimum length as well.. 10 characters.

by cpr

Most people have a bank card with a PIN number. This number is usually a 4 digit, easily remembered number. This seems to work well because people realize the implications if they give out this number. Education is a very important element in security administration which is often overlooked.

If people realized the potential implications of allowing others to use their computer account, many potential abuses would be reduced.

You might want to consider a PIN number to validate your account/password (in effect, a password for a password).

Two simple passwords might be better than a single tough one?

This discussion is closed to new replies.