3 ms·
Harmj0y, who is probably the best public AD hacker right now suggests 3 month rotations, IIRC. My guess is the idea is to mitigate compromise of very old passw
by hsbauauvhabzb 6y ago
Harmj0y, who is probably the best public AD hacker right now suggests 3 month rotations, IIRC.
My guess is the idea is to mitigate compromise of very old passwords, spray attacks using breached site creds, reduce insider threat and at least offer some mitigation for compromised hashes.
I think this is wise compared in work environments - 90 days, 180 or even 360 would be a good mitigation over _none_ to too many.
- acdha 6y agoI think those concerns are better addressed elsewhere with tools like MFA, automatically disabling inactive accounts, or monitoring public services like HIBP to deactivate accounts quickly. Attackers can move quickly so you hit diminishing returns on rotation policies trying to avoid usability issues incentivizing worse passwords while not rotating long after the account has been compromised.
- hsbauauvhabzb 6y agoOh! Please tell me how you implement MFA on AD domains!
- kipchak 6y agoAzure AD/Azure AD hybrid might be worth a look