4 ms·

It wouldn't surprise me if this were a regulation requirement, since most very large companies I've worked with all have pretty much identical password expirati

It wouldn't surprise me if this were a regulation requirement, since most very large companies I've worked with all have pretty much identical password expiration policies.

xxpor 6y ago
PCI is, practically speaking, nearly the same as an actual regulation, given how stringent and widespread it is.
jrodthree24 6y ago
This requirement can come from lots of places. I remember at the last place I worked, we had to get audited for SOC2 compliance and password expiry was part of the requirement. I imagine these things lag behind the recommended security guidelines by quite a few years.
- xmprt 6y ago
  It feels extremely negligent of third party auditors to recommend (and sometimes require) companies to enforce worse, obsolete security practice.
  - underwater 6y ago
    SOC 2 is defined by the American Institute of Certified Public Accountants. Having computer security defined by accountants seems crazy, but is in the style of the bureaucratic mess of modern enterprise.
- tracker1 6y ago
  Don't recall for SOC2 specifically, but a lot of the time, "best practices" suggestions and the requirements weren't the same, and people codified the suggestions internally, or the reviewers/auditors would.
closeparen 6y ago
Regulation is usually pretty light on specific technical measures, it says something vague like "you must follow best practices" and then there's industry consensus / rumors about what those are.
- xxpor 6y ago
  That's really dependent on what regulation you're talking about. The FCC has some extremely specific rules in Part 15, for example.
PeterisP 6y ago
Change travels very slowly - some years ago NIST and everybody else's recommendations used to require password rotation, so lots of policies and habits of policy writers/enforcers and educational materials still echo the old recommendations.
mumblemumble 6y ago
I've also seen it written into business contracts with clients. Which makes it almost impossible to change, because doing so would require both sides to agree to pay for an expensive (and irksome) exchange between their respective legal teams.
- tracker1 6y ago
  Working with govt agencies, this is somewhat painful. "Must be AES256 encrypted at rest." is one of my favorites.
acdha 6y ago
One thing to remember that large companies love things which they can point to if something goes wrong. PCI isn't regulation but it's widespread because the credit card companies require it. Depending on the industry you might also find CIS pretty common (https://www.cisecurity.org/ https://www.cisecurity.org/) and the U.S. federal government space will mention STIG (https://public.cyber.mil/stigs/ https://public.cyber.mil/stigs/). These are built into common assessment tools so you'll get identical policies down to things like byte-for-byte identical PAM module config because most places just licensed one of these tools and demanded everyone use it.

It wouldn't surprise me if this were a regulation requirement, since most very large companies I've worked with all have pretty much identical password expiration policies.

xxpor 6y ago

PCI is, practically speaking, nearly the same as an actual regulation, given how stringent and widespread it is.

jrodthree24 6y ago

This requirement can come from lots of places. I remember at the last place I worked, we had to get audited for SOC2 compliance and password expiry was part of the requirement. I imagine these things lag behind the recommended security guidelines by quite a few years.

xmprt 6y ago
It feels extremely negligent of third party auditors to recommend (and sometimes require) companies to enforce worse, obsolete security practice.
- underwater 6y ago
  SOC 2 is defined by the American Institute of Certified Public Accountants. Having computer security defined by accountants seems crazy, but is in the style of the bureaucratic mess of modern enterprise.
tracker1 6y ago
Don't recall for SOC2 specifically, but a lot of the time, "best practices" suggestions and the requirements weren't the same, and people codified the suggestions internally, or the reviewers/auditors would.

closeparen 6y ago

Regulation is usually pretty light on specific technical measures, it says something vague like "you must follow best practices" and then there's industry consensus / rumors about what those are.

xxpor 6y ago
That's really dependent on what regulation you're talking about. The FCC has some extremely specific rules in Part 15, for example.

PeterisP 6y ago

Change travels very slowly - some years ago NIST and everybody else's recommendations used to require password rotation, so lots of policies and habits of policy writers/enforcers and educational materials still echo the old recommendations.

mumblemumble 6y ago

I've also seen it written into business contracts with clients. Which makes it almost impossible to change, because doing so would require both sides to agree to pay for an expensive (and irksome) exchange between their respective legal teams.

tracker1 6y ago
Working with govt agencies, this is somewhat painful. "Must be AES256 encrypted at rest." is one of my favorites.

acdha 6y ago

One thing to remember that large companies love things which they can point to if something goes wrong. PCI isn't regulation but it's widespread because the credit card companies require it. Depending on the industry you might also find CIS pretty common (https://www.cisecurity.org/ https://www.cisecurity.org/) and the U.S. federal government space will mention STIG (https://public.cyber.mil/stigs/ https://public.cyber.mil/stigs/). These are built into common assessment tools so you'll get identical policies down to things like byte-for-byte identical PAM module config because most places just licensed one of these tools and demanded everyone use it.