4 ms·
NIST finally jumped on the “long passwords are stupid and password rotations are for suckers” bandwagon about 3 years ago. Problem is PCI, HIPAA and others hav
by CyanLite4 6y ago
NIST finally jumped on the “long passwords are stupid and password rotations are for suckers” bandwagon about 3 years ago.
Problem is PCI, HIPAA and others haven’t changed their rules to accommodate. However, auditors aren’t stupid. I’ve told mine, “here, look at the new NIST standard” and they say “okay, yea MFA is better”. As long as you can point to their technology standards agency (NIST, FIPS, DISA, etc) you should be good to go.
- whydoyoucare 6y agoThis has been my experience too. Typically, standard bodies move at a different pace, and as long as you use a reputable known standard, you're good to go.