8 ms·
My understanding is the biggest driver of still having mandatory password rotation is PCI (the payments security requirements, not the bus)
by xxpor 6y ago
My understanding is the biggest driver of still having mandatory password rotation is PCI (the payments security requirements, not the bus)
- mywittyname 6y agoIt wouldn't surprise me if this were a regulation requirement, since most very large companies I've worked with all have pretty much identical password expiration policies.
- xxpor 6y agoPCI is, practically speaking, nearly the same as an actual regulation, given how stringent and widespread it is.
- jrodthree24 6y agoThis requirement can come from lots of places. I remember at the last place I worked, we had to get audited for SOC2 compliance and password expiry was part of the requirement. I imagine these things lag behind the recommended security guidelines by quite a few years.
- xmprt 6y agoIt feels extremely negligent of third party auditors to recommend (and sometimes require) companies to enforce worse, obsolete security practice.
- underwater 6y agoSOC 2 is defined by the American Institute of Certified Public Accountants. Having computer security defined by accountants seems crazy, but is in the style of the bureaucratic mess of modern enterprise.
- tracker1 6y agoDon't recall for SOC2 specifically, but a lot of the time, "best practices" suggestions and the requirements weren't the same, and people codified the suggestions internally, or the reviewers/auditors would.
- closeparen 6y agoRegulation is usually pretty light on specific technical measures, it says something vague like "you must follow best practices" and then there's industry consensus / rumors about what those are.
- xxpor 6y agoThat's really dependent on what regulation you're talking about. The FCC has some extremely specific rules in Part 15, for example.
- PeterisP 6y agoChange travels very slowly - some years ago NIST and everybody else's recommendations used to require password rotation, so lots of policies and habits of policy writers/enforcers and educational materials still echo the old recommendations.
- mumblemumble 6y agoI've also seen it written into business contracts with clients. Which makes it almost impossible to change, because doing so would require both sides to agree to pay for an expensive (and irksome) exchange between their respective legal teams.
- tracker1 6y agoWorking with govt agencies, this is somewhat painful. "Must be AES256 encrypted at rest." is one of my favorites.
- acdha 6y agoOne thing to remember that large companies love things which they can point to if something goes wrong. PCI isn't regulation but it's widespread because the credit card companies require it. Depending on the industry you might also find CIS pretty common (https://www.cisecurity.org/ https://www.cisecurity.org/) and the U.S. federal government space will mention STIG (https://public.cyber.mil/stigs/ https://public.cyber.mil/stigs/). These are built into common assessment tools so you'll get identical policies down to things like byte-for-byte identical PAM module config because most places just licensed one of these tools and demanded everyone use it.
- quesera 6y agoThat's correct. PCI DSS section 8.2.4(a) requires that passwords are changed at least every 90 days. Other requirements from the same section: retain old passwords to disallow dupes for at least 5 cycles, passwords must be minimum 7 chars, and contain both alpha and numeric. You might be able to justify non-compliance with a compensating control, but I've never heard of anyone who tried it. Note that this only applies to employees who are in PCI scope. Most internal staff are not, and should not be! Similar policies are common for all users though. They pre-date PCI (which is how they became part of PCI DSS) and now PCI's retention of these policies justifies continued use elsewhere. The tail wags the dog.
- inter_netuser 6y agowouldn't MFA/OTP be sufficient to compensate?
- quesera 6y agoPCI DSS section 8.3 requires MFA explicitly. The logical assumption is that PCI does not consider satisfaction of 8.3 to be a compensating control for the requirements in 8.2.4 -- however I've never heard of anyone who made the attempt. ... PCI is a weird mix of requirements, evaluations, and compensations. The final authority is the PCI org themselves (i.e. the card networks), but the eval is performed by PCI-approved third parties, for report to your business partners. Requirements are extensive but not always definitive. Compensations are subjective, at best. Enforcement is sketchy but can be devastating. The usual approach is to comply, comply, comply, and accept that some of it is policy theater, but it's rarely bad policy. Password rotation is bad policy, but ironically it's mitigated by MFA!
- AmericanChopper 6y agoI’ve had a number of Level 1 merchants/service providers ditch PCI password complexity/rotation rules, and I’ve always managed to get it accepted by QSAs. The compensating control is to implement the full NIST recommendation (like enforcing an extra long password length, monitoring for compromised passwords, having a documented passphrase policy, etc...), and in your compensating control worksheet describe how those practices go above and beyond the DSS requirements. That bits quite simple, because there’s plenty of authoritative resources you can reference to justify that position. The harder part is coming up with a justification for why you need to implement that compensating control. Because a compensating control can only be implemented to address a legitimate business/technical constraint. But that bit really just takes a little creativity.
- gdw2 6y agothis. I wonder if Microsoft employees (all or portions) have to rotate their passwords due to PCI compliance despite Microsoft's stance on the subject.
- hirsin 6y agoNot any more, as of a year or two ago? We finally updated our internal structure to follow the NIST guidelines we helped write.
- sd6594 6y agoRumors has that the next PCI-DSS revision will change that requirement.
- jrnichols 6y agoI have the feeling that HIPAA requirements are also another driver.
- bashinator 6y agoHIPAA isn’t nearly as prescriptive as PCI. It’s more about defining what PHI is, and what the consequences are for mishandling it.
- dragonwriter 6y ago> HIPAA isn’t nearly as prescriptive as PCI. For odd historical reasons HIPAA is passive-aggressively prescriptive through the definition of secured PHI in guidance issued under the HITECH act, whereas the basic Privacy and Security Rules are less so. > It’s more about defining what PHI is, and what the consequences are for mishandling it. Well, the Administrative Simplification part of HIPAA (which is far from the whole thing, and which the Privacy and Security pieces are in turn smaller components of) are really more about standardizing and encouraging use of health IT in multiparty interactions in healthcare. The Privacy and Security aspects were included largely to mitigate public fear of shared, common-format digital transactions and records being a privacy risk.
- earthboundkid 6y agoI asked my company IT why we still have mandatory rotation and I was told it is due to PCI.