5 ms·
Password Rotation and stagnant security practises are IMO a result of liablity environments, not regulatory environments.
by zaarn 7y ago
Password Rotation and stagnant security practises are IMO a result of liablity environments, not regulatory environments.
- scarejunba 7y agoInteresting. I can see the rationale for that: we currently exist in a liability environment and that's where we are. The CYA process means that people stick to what's already there because introducing a change means you're on the hook for the change. What I hoped for is that I, as a startup, can beat the government on picking a security standard because the government has to cater to all but I can just beat it by being better than Big Slow Dinosaur (BSD). But because I have to integrate at some level with BSD that has to follow the government I lose that advantage. I suppose, with a regulator capable of moving fast to respond to threats, aware of sunset periods, regulation could be superior. Somehow, I expect forums like this one to be full of software engineers complaining about "the constantly changing requirements from NIST" if that were to happen.
- icebraining 7y agoIf instead of liability, you had a regulation mandating the implementation of specific guidelines, they'd use the ones produced by NIST, which until 2017 also recommended password rotation.
- zaarn 7y agoThere is no reason why regulatory bodies cannot be up-to-date with the latest developments.
- scarejunba 7y agoAnd yet, strangely, they never do.
- zaarn 7y agoMaybe because American legislation loves to cripple regulatory bodies?