5 ms·

NIST no longer suggests such a rotation policy. They have accepted that it weakens security. Anecdotally, colleagues have successfully lobbied to drop (or not

• Jtsummers 6y ago
  Yeah, I know it's not actually recommended anymore, but the policy makers don't care. They're doing CYA policy. They do whatever seems to be the strongest possible thing, users and reality be damned. I was in a team whose security group eliminated the use of DVD drives for reading (not writing) data except for a few permitted individuals. Creating a massive chokepoint in every process where data had to come from off-network. Security didn't care, it took the realization of the cost (delays, people too busy moving data to do their actual jobs) for management to step in and end the nonsense. The same will be required for things like password policies. Until the issue becomes realized (weak/written passwords lead to a compromise), these policies will stay in place within organizations and teams. It doesn't help that the majority of the policy setters are not IT professionals (or only in the loosest sense, they can install software but have no real understanding of IT systems). In DoD, most come from a physical security background (retired/separated security forces).
  • mumblemumble 6y ago
    > They do whatever seems to be the strongest possible thing It's not that, it's inertia and poor incentive structures. In a large organization, if a policy was set in place by someone else, then, even when you know it's a sub-par policy, it's still in your interest to leave it alone. Doing so gives you a way to deflect blame in the event of a breach related to that decision. You can just blame the policy itself. If, on the other hand, you change the policy, you're more likely to be held personally accountable. That said, you're also absolutely right about the expertise problem. I don't know much about government, but, in private industry, I've observed that the best way to get put in charge of cybersecurity is to start from somewhere completely outside of IT, and become good friends with the CEO.
    • craftinator 6y ago
      > It's not that, it's inertia and poor incentive structures. This is the psychological/economics point of view, and I think it's the correct one for this problem. The other tricky issue, besides the CYA prioritization, is that being a dynamic entity requires other entities to do the same. If you start changing procedures in your section, other sections that rely on you need to adapt to these, and they may have the CYA attitude and resist that change.
    • Godel_unicode 6y ago
      It's certainly possible that in some cases that's true, but there are a lot of government check-box security people who genuinely believe complex passwords rotated frequently are a good security control. There's also a general heuristic with many people in security that the more convenient something is, the less secure it is. Therefore smart card auth must be worse!
• kodah 6y ago
  Citation? I couldn't find anything on the web or here: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html edit: I wasn't calling OP a liar, I just couldn't find it.
  • NovemberWhiskey 6y ago
    It's right there in section 5.1.1.2: "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)."
    • hsbauauvhabzb 6y ago
      Harmj0y, who is probably the best public AD hacker right now suggests 3 month rotations, IIRC. My guess is the idea is to mitigate compromise of very old passwords, spray attacks using breached site creds, reduce insider threat and at least offer some mitigation for compromised hashes. I think this is wise compared in work environments - 90 days, 180 or even 360 would be a good mitigation over _none_ to too many.
      • acdha 6y ago
        I think those concerns are better addressed elsewhere with tools like MFA, automatically disabling inactive accounts, or monitoring public services like HIBP to deactivate accounts quickly. Attackers can move quickly so you hit diminishing returns on rotation policies trying to avoid usability issues incentivizing worse passwords while not rotating long after the account has been compromised.
        • hsbauauvhabzb 6y ago
          Oh! Please tell me how you implement MFA on AD domains!
          • 6y ago
• jimnotgym 6y ago
  However I'm pretty sure PCIDSS does still say 90 days
  • boston_clone 6y ago
    all the more reason to prioritize minimization of scope for PCI ;)
  • downtown_ 6y ago
    You are allowed to use the NIST Guidance as a reason to change that to a longer timeframe. I have a couple of clients that are using 365days as of 2019.
  • syshum 6y ago
    PCIDSS is largely security theater as well, there are many many many problems with it.
• briffle 6y ago
  Yes, but as far as I have seen, not auditing/compliance frameworks have updated their recommendations yet. Maybe its not the frameworks, but the individual auditors and their templates, but I have seen it a 'requirement' for PCI, sarbenes-oakly, etc. its much easier to keep it in place to make the auditors happy than remove it, and risk exceptions on your report that you have to defend.
• 0xffff2 6y ago
  None the less, until the pandemic hit the US in March, at least one large government agency still had silly password complexity requirements and expired passwords every 60 days. They seems to have suspended password rotation at some point since I haven't had to change my password since March, but it's not clear whether it's going to come back at some point or not.
  • Spooky23 6y ago
    IRS still requires stupid complexity and lockouts in the beloved pub 1075.