6 ms·

> You might be able to justify non-compliance with a compensating control, but I've never heard of anyone who tried it. I just did similarly within a SOC2 audi

> You might be able to justify non-compliance with a compensating control, but I've never heard of anyone who tried it. I just did similarly within a SOC2 audit. I sent the auditors a list of 50+ articles and references i've been maintaining for years saying that password changing is a bad idea (this article is on the list) from many different sources. I never heard back and the item was marked approved by them.

smallnamespace 6y ago
Would you consider sharing it? Might be useful for others in the same boat.
sadness3 6y ago
Can you please pop this list of articles into pastebin and paste it here? tyvm
- technion 6y ago
  This hasn't been updated in a while but there's plenty of references: https://gist.github.com/technion/65c652194fb1427e6828ea23ff46d280 https://gist.github.com/technion/65c652194fb1427e6828ea23ff4...
- AdamJacobMuller 6y ago
  Also, https://www.troyhunt.com/passwords-evolved-authentication-guidance-for-the-modern-era/ https://www.troyhunt.com/passwords-evolved-authentication-gu... forcing https://www.washingtonpost.com/news/the-switch/wp/2016/03/02/the-case-against-the-most-annoying-security-measure-virtually-every-workplace-uses/?utm_term=.1350ceebe1b1 https://www.washingtonpost.com/news/the-switch/wp/2016/03/02... regular https://www.wired.com/2016/03/want-safer-passwords-dont-change-often/ https://www.wired.com/2016/03/want-safer-passwords-dont-chan... password https://practical365.com/security/microsoft-recommending-non-expiring-passwords-to-office-365-customers/ https://practical365.com/security/microsoft-recommending-non... changes https://www.scmagazineuk.com/end-password-expiry/article/1477603 https://www.scmagazineuk.com/end-password-expiry/article/147... is https://www.sans.org/security-awareness-training/blog/time-password-expiration-die https://www.sans.org/security-awareness-training/blog/time-p... a https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r... bad https://arstechnica.com/information-technology/2016/08/frequent-password-changes-are-the-enemy-of-security-ftc-technologist-says/ https://arstechnica.com/information-technology/2016/08/frequ... idea https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r... can https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html https://www.schneier.com/blog/archives/2016/08/frequent_pass... you https://cryptosmith.com/password-sanity/exp-harmful/ https://cryptosmith.com/password-sanity/exp-harmful/ please https://www.zdnet.com/article/changing-your-password-regularly-is-a-terrible-idea-and-heres-why/ https://www.zdnet.com/article/changing-your-password-regular... stop https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry https://www.ncsc.gov.uk/articles/problems-forcing-regular-pa... this was one of the more cheeky version I sent to a vendor.

smallnamespace 6y ago

Would you consider sharing it? Might be useful for others in the same boat.

sadness3 6y ago

Can you please pop this list of articles into pastebin and paste it here? tyvm

technion 6y ago
This hasn't been updated in a while but there's plenty of references: https://gist.github.com/technion/65c652194fb1427e6828ea23ff46d280 https://gist.github.com/technion/65c652194fb1427e6828ea23ff4...
AdamJacobMuller 6y ago
Also, https://www.troyhunt.com/passwords-evolved-authentication-guidance-for-the-modern-era/ https://www.troyhunt.com/passwords-evolved-authentication-gu... forcing https://www.washingtonpost.com/news/the-switch/wp/2016/03/02/the-case-against-the-most-annoying-security-measure-virtually-every-workplace-uses/?utm_term=.1350ceebe1b1 https://www.washingtonpost.com/news/the-switch/wp/2016/03/02... regular https://www.wired.com/2016/03/want-safer-passwords-dont-change-often/ https://www.wired.com/2016/03/want-safer-passwords-dont-chan... password https://practical365.com/security/microsoft-recommending-non-expiring-passwords-to-office-365-customers/ https://practical365.com/security/microsoft-recommending-non... changes https://www.scmagazineuk.com/end-password-expiry/article/1477603 https://www.scmagazineuk.com/end-password-expiry/article/147... is https://www.sans.org/security-awareness-training/blog/time-password-expiration-die https://www.sans.org/security-awareness-training/blog/time-p... a https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r... bad https://arstechnica.com/information-technology/2016/08/frequent-password-changes-are-the-enemy-of-security-ftc-technologist-says/ https://arstechnica.com/information-technology/2016/08/frequ... idea https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r... can https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html https://www.schneier.com/blog/archives/2016/08/frequent_pass... you https://cryptosmith.com/password-sanity/exp-harmful/ https://cryptosmith.com/password-sanity/exp-harmful/ please https://www.zdnet.com/article/changing-your-password-regularly-is-a-terrible-idea-and-heres-why/ https://www.zdnet.com/article/changing-your-password-regular... stop https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry https://www.ncsc.gov.uk/articles/problems-forcing-regular-pa... this was one of the more cheeky version I sent to a vendor.