4 ms·
NIST stopped recommending regular password rotation years ago. Why are mega corps still insisting on this? Security theater? Unknowledgable?
by TedDoesntTalk 4y ago
NIST stopped recommending regular password rotation years ago. Why are mega corps still insisting on this? Security theater? Unknowledgable?
- solarmist 4y agoYes and trying to find a bargain on staff.
- ornornor 4y ago“We’ve always done it this way so we’re not about to change”, or a customer somewhere has an audit checklist that mandates password rotations every 3 months. I know of people stuck with such a moronic password change policy, and the new password can’t be the same as the last five or whatever. So they change the password five times in a row so they can keep using the same password over and over. This kind of thing makes me so so so depressed about work. It’s overwhelmingly self inflicted suffering for no benefit, and it makes millions of people miserable for nothing.
- jve 4y agoMS has their guidance also not recommending password cycling: https://www.microsoft.com/en-us/research/wp-content/uploads/2016/06/Microsoft_Password_Guidance-1.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/... But he mentioned servers not users. If those are Windows Servers in AD env, LAPS exists: https://www.microsoft.com/en-us/download/details.aspx?id=46899 https://www.microsoft.com/en-us/download/details.aspx?id=468...