Security

Ask something
Discussion Locked

Periodic Password changes

0 helpful
6 replies

by leightonn 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
How long do you think you should force users to change their passwords? I have a policy to force changes every 60 days. That would mean that they have to change their passwords about 6 times a year. Some users complain that they are running out ofpasswords because they are not allowed to reuse passwords. It's better to be safe than inconvenienced.

6 replies

by tekguy610

We'll I'm not the main admin here but we don't change our passwords unfortunetly. If it was up to me though it would be once a month. It may be harsh but that would be doubling up my security then every 60 days. But I would let them reuse the passwords. just not every month.

by pills

making users change there password every 60 days is good practice, but I find they start writting them on paper and sticking them to their monitor or in their top draw, I've also found that the worst people for not changing their passwords are the I.T staff, If their password gets discovered a user or hacker would have full access to the system, My previous boss has still not changed any of the passwords to his system. although we still get on and he can trust me I don't believe its good practice. and they should have been changed as soon as I left.

by sixfourtykilo

Working for a bank, security is a big issue for customer loyalty, blah, blah, blah. Passwords are changed her every 30 days. Not only is it that secure, but rules for changing passwords are also very strict. Passwords must be more than 6 characters, cannot contain repeating characters, cannot have anything to do with banking, and the last six passwords cannot be used again. This can cause problems too because when the users run out of ideas, our helpdesk suggest easy to remember words.

My personal suggestion would be to enforce 45-day grace periods with the addition of remembering six passwords, etc, etc.

640k

by l lynch

It depends upon the nature of your business and the type of people your users are.

We have a policy that for User passwords are changed quarterly and the Users that have access to more privilege/confidential information - their passwords are changed monthly.

by kitkat514

The decision when to change can be balanced around what you are trying to protect.
For highly sensitive data more frequently and stringent the rules must be.
For personal and private use, you may never change.
Its a fine balancing act.
I run different rules for different systems and applications. Initially against quite some resistance, now however the users are coping well.

by ms

All the policy depends what is your company profile.

I`m workin in bank and I don`t care about complaining. We are not making plastic monkeys producer we are carying our customers money, and we have to have strong policy even in non bankin` segment network.

We are changing passwords in 14 days and have 5 steps backward changing to not double pass.

the most important thing is password mask.

I prefer xxxXXxxx -x letter -X digit (but of course you can add digit or letters.

This discussion is closed to new replies.