Software
Does anyone have any information on a password law either fereral or state that says businesses must force user to change their password every 30, 60, 90 days etc.
Thanks
by dheinack Accepted solution
by tig2 Accepted solution
Are at this point generally "suggestions" by whatever regulatory requirement that you are trying to manage to.
Most HIPPA compliance is based on 90 day change and strong definition- upper and lower case, alpha-numeric, requiring special chars, minimum string length, generally 8. And the guide line is a minimum of 3 characteristics met. So pA55word would meet the guide line, pA55w*rd would exceed- has all 4 characteristics.
You will find it much the same for other regulatory points.
Generally when you see a requirement, it is around domain division when sharing with an outside business partner, Federated Identity (SAML assertion from the Identity Provider to the Service Provider), encryption of data at rest and in motion, etc. Generally those requirements are an element of the regulatory point you are trying to satisfy- PCI, for instance requires data at rest to be encrypted.
There isn't really a mandate for any point. The regulations simply give a guideline and let you sort it for yourself.
Please note- I am speaking to my own knowledge in the US.
by naughtymonkey Accepted solution
that since these are mainly suggestions, it is up to the company to decide what measures they take to protect themselves. If, however, they are hacked and charges are brought up against the company, they will have to prove that they took the necessary precautions to protect their data.
In other words, if you only make users have 3 letter passwords and then customer account info is stolen and the company sued, most likely it will be determined their fault for not taking the precautionary measures that were necessary.
by retro77 Accepted solution
This discussion is closed to new replies.
Sort by Trending