3 ms·
It's no longer a recommended industry standard, but unfortunately, it is still basically required, because many compliance policies have not updated. I would be
by ocdtrekkie 6y ago
It's no longer a recommended industry standard, but unfortunately, it is still basically required, because many compliance policies have not updated. I would be shocked if at least some of Microsoft is still required to employ password rotation policies because of their own compliance requirements.
At least one policy I am looking at maintains the 90 day rotation requirement if you use basic password authentication, but offers alternative options for compliance with other authentication features. But even most of those tend to have yearly rotation requirements.
- muttled 6y agoWording is important too. You can't say something you'd like to move to "no passwords." You might get further with "password-less."
- artful-hacker 6y agoPCI-DSS is commonly cited as having this requirement, and its a huge pain in my ass.
- xtracto 6y agoI just went through PCI-DSS and SOC2 certifications in the last 3 months. OMG was that painful.
- pitaj 6y agoRecently had a long discussion over email with an executive security officer of my company regarding this topic. Their conclusion was basically "until the standards change this is how it will be".
- tallanvor 6y agoI suspect Microsoft uses JIT policies for accounts that would be subject to password rotation - you have a separate account that has access to sensitive data, but it's normally locked. When you need to do something, you initiate an access request that requires either a smart card or hardware security key. Depending on the type of access required, another person may have to ok the request. Once approved, the account is unlocked for a set period of time with a new password.