3 ms·
If we're going to start firing people, first on my chopping block would be IT staff who implement security theater policies which go against NIST recommendation
by Jach 8y ago
If we're going to start firing people, first on my chopping block would be IT staff who implement security theater policies which go against NIST recommendations (like forced rotation of passwords every x days) and create security hygiene problems as side effects.
- monocasa 8y agoUnfortunately PCI compliance requires rotating passwords last time I checked. : \
- analogmemory 8y agoand then you get Password1990!!!!!!
- MaxGabriel 8y agoThat's correct :( > 8.2.4 Change user > passwords/passphrases at least once > every 90 days.
- downtown_ 8y agoNo. You are free to reference nist and use a compensating control for that. No more pw changes :) Source: QSA
- monocasa 8y agoI guess I was under the impression that compensating controls don't really let you question the efficacy of the point of the original requirement, but instead "we're meeting the requirement in this other way"?