{"id":286556,"date":"2021-06-29T15:00:48","date_gmt":"2021-06-29T12:00:48","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/why-mandatory-password-expirations-dont-make-sense-anymore-cloudsavvy-it\/"},"modified":"2021-06-29T15:00:48","modified_gmt":"2021-06-29T12:00:48","slug":"why-mandatory-password-expirations-dont-make-sense-anymore-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/why-mandatory-password-expirations-dont-make-sense-anymore-cloudsavvy-it\/","title":{"rendered":"#Why Mandatory Password Expirations Don\u2019t Make Sense Anymore \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aee05fedfa1b\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6aee05fedfa1b\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/why-mandatory-password-expirations-dont-make-sense-anymore-cloudsavvy-it\/#What_Does_Password_Expiration_Solve\" >What Does Password Expiration Solve?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/why-mandatory-password-expirations-dont-make-sense-anymore-cloudsavvy-it\/#The_Issues_With_Password_Expirations\" >The Issues With Password Expirations<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/why-mandatory-password-expirations-dont-make-sense-anymore-cloudsavvy-it\/#The_Tides_Turning_Against_Changing_Your_Password\" >The Tide\u2019s Turning Against Changing Your Password<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/why-mandatory-password-expirations-dont-make-sense-anymore-cloudsavvy-it\/#What_To_Use_Instead\" >What To Use Instead?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/why-mandatory-password-expirations-dont-make-sense-anymore-cloudsavvy-it\/#Conclusion_Time_to_Stop_Expiring_Passwords\" >Conclusion: Time to Stop Expiring Passwords<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#Why Mandatory Password Expirations Don\u2019t Make Sense Anymore \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<figure style=\"width: 2052px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage wp-image-12319 size-full\" data-pagespeed-lazy-src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/06\/c8fec137.png?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"passwords on paper\" width=\"2052\" height=\"1060\" src=\"https:\/\/www.shutterstock.com\/image-photo\/strong-weak-easy-password-note-pad-1197236665\" data-credittext=\"Vitalii Vodolazskyi\/Shutterstock.com\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><figcaption class=\"wp-caption-text\"><span class=\"type:primaryImage imagecredit\"><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.shutterstock.com\/image-photo\/strong-weak-easy-password-note-pad-1197236665\">Vitalii Vodolazskyi\/Shutterstock.com<\/a><\/span><\/figcaption><\/figure>\n<p>Mandatory password changes on a regular timeframe are a fact of life within many organizations. This age-old practice is upheld by proponents as a good baseline security measure to mitigate the risks of password loss. But is it still relevant decades after it first <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>eared?<\/p>\n<h2 id=\"what-does-password-expiration-solve\"><span class=\"ez-toc-section\" id=\"What_Does_Password_Expiration_Solve\"><\/span>What Does Password Expiration Solve?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>First, it\u2019s important to understand why enforced password expirations became popular. Most organizations require a password change every 30 or 90 days. This <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.sans.org\/blog\/time-for-password-expiration-to-die\">dates from the historical background<\/a> of simpler password hashes which could be cracked relatively quickly. Back when an attacker could crack a password in a couple of months, security practitioners suggested that changes within that timeframe would help to keep users safe.<\/p>\n<p>Today\u2019s threat model looks rather different. Passwords encrypted with modern hashing mechanisms <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/bitcoin.stackexchange.com\/questions\/41829\/wont-asic-miners-eventually-break-sha-256-encryption\/41842\">could take billions<\/a> of years to successfully crack.<\/p>\n<p>Nowadays criminals collect passwords in ways that focus on you, the user, instead of the service that stores them. Phishing and <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">social<\/a> engineering attacks are the greatest risks, as well as coordinated dictionary attacks using lists of known passwords. These lists are sourced from previous data breaches.<\/p>\n<p>The changes in the threat landscape mean password expirations no longer solve the problem they were intended for. Compromises happen in seconds. By the time you change your password, the attackers are probably long gone.<\/p>\n<h2 id=\"the-issues-with-password-expirations\"><span class=\"ez-toc-section\" id=\"The_Issues_With_Password_Expirations\"><\/span>The Issues With Password Expirations<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Enforced password changes are a common frustration among users. They may be inclined to choose a succession of short passwords that are easily memorized. Some users will note each password down, potentially exposing it to compromise \u2013 whether in a text file, or as a desktop post-it note.<\/p>\n<p>Research at the University of North Carolina <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/www.cs.unc.edu\/~fabian\/papers\/PasswordExpire.pdf\">found an attacker with access<\/a> to <em>previous<\/em> passwords could determine the user\u2019s <em>current<\/em> password in under 3 seconds in 41% of cases. This provides strong evidence that many users make only trivial changes to their passwords at the mandated interval.<\/p>\n<p>Password expirations are meant to place a time limit on an attacker\u2019s access to a compromised system. In today\u2019s changed landscape, an intruder may already have persistent access by the time they steal the password list. Installing a key logger or other similar malware immediately sidesteps all the benefits of password expiration.<\/p>\n<p>Finally, real-world pen-testers <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.sans.org\/blog\/time-for-password-expiration-to-die\">have stated they\u2019re<\/a> not encumbered by a password expiration policy. Policies are often defending against threats they cannot hope to contain. These days, regular password changes should be seen as an effort to encourage users to maintain security. In practice, it\u2019s poorly suited to this too, as it presents an inconvenience which users will try to avoid.<\/p>\n<p><strong>RELATED:<\/strong> <strong><em>How to Protect Your Organization Against Password Dictionary Attacks<\/em><\/strong><\/p>\n<h2 id=\"the-tides-turning-against-changing-your-password\"><span class=\"ez-toc-section\" id=\"The_Tides_Turning_Against_Changing_Your_Password\"><\/span>The Tide\u2019s Turning Against Changing Your Password<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>These factors combined have led several prominent organizations to turn against password change policies in recent years. From the UK\u2019s <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.ncsc.gov.uk\/blog-post\/problems-forcing-regular-password-expiry\">National Cyber Security Centre (NCSC)<\/a> to Microsoft\u2019s <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.microsoft.com\/en-gb\/archive\/blogs\/secguide\/security-baseline-final-for-windows-10-v1903-and-windows-server-v1903\">official Windows security baseline<\/a>, the once ubiquitous practice has rapidly dropped out of favor.<\/p>\n<p>In a blog post in 2016, the NCSC explained that expirations present a \u201cusability cost\u201d to users that outweighs already questionable security benefits:<\/p>\n<blockquote><p>It\u2019s one of those counter-intuitive security scenarios; the more often users are forced to change passwords, the greater the overall vulnerability to attack. What appeared to be a perfectly sensible, long-established piece of advice doesn\u2019t, it turns out, stand up to a rigorous, whole-system analysis.<\/p>\n<\/blockquote>\n<p>The impact of password fatigue is more likely to weaken an organization\u2019s overall security posture, as users will choose less secure passwords and drop their guard against ongoing threats. Attackers won\u2019t be perturbed by a password expiration policy \u2013 information gets stolen in an instant, usually long before a scheduled password change could mitigate the impact.<\/p>\n<h2 id=\"what-to-use-instead\"><span class=\"ez-toc-section\" id=\"What_To_Use_Instead\"><\/span>What To Use Instead?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>System administrators still have several tools to protect their organizations. Of the options available, education can be one of the strongest long-term approaches. Explain to users the risks of low security passwords to encourage them to make safer choices.<\/p>\n<p>You should also adopt a multi-factored authentication approach. Adding an authentication app to the equation prevents attackers from using passwords, even if they successfully steal them. This wasn\u2019t possible back when password expiration policies first started to be adopted.<\/p>\n<p>If you still insist on regular password changes, or your industry has legislation that requires it, find ways to help your users. Providing approved password management software will let users generate and store secure passwords, without resorting to simple phrases scrawled on note paper.<\/p>\n<p>Dropping password expirations doesn\u2019t mean abandoning all password control mechanisms. You can still enforce a minimum length and complexity to guide users towards strong choices. In addition, you should retain the ability to invalidate passwords so you can quickly lock down your systems in the event of a breach.<\/p>\n<p><strong>RELATED:<\/strong> <strong><em>Don&#8217;t Leave Passwords in Your Code; Use AWS&#8217;s Secrets Manager Instead<\/em><\/strong><\/p>\n<h2 id=\"conclusion-time-to-stop-expiring-passwords\"><span class=\"ez-toc-section\" id=\"Conclusion_Time_to_Stop_Expiring_Passwords\"><\/span>Conclusion: Time to Stop Expiring Passwords<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Password expirations used to be reasonably effective at stopping the cyberattacks of yesterday\u2019s web. Now they\u2019re more trouble than they\u2019re worth. Continuing to enforce regular password changes will frustrate users, cause more IT help desk queries and deliver negligible \u2013 or negative \u2013 effects on your security posture.<\/p>\n<p>Expiration policies were helpful when the web was a smaller and slower place. The internet and its threats have evolved immensely over the past couple of decades. It\u2019s now more common for users to tell an attacker their password, in a phishing email or on a scam call, than a password to be actually \u201cstolen\u201d by an intruder.<\/p>\n<p>For systems where persistent access is a risk, acquiring a privileged user\u2019s password once usually gives an attacker the capability to install a backdoor or set up their own user account. With so many factors stacking against password expiration as a security mitigation, it\u2019s now more important to focus on basic password hygiene and the bigger picture of cyber defenses.<\/p>\n<p>Dropping your password expiration policy should please users and contribute to your security standing. Weigh the security benefits of your password practices against the usability cost of making users relearn their credentials every few months. Many compliance regulations such as PCI-DSS and HIPAA still require regular password changes but in non-regulated industries, you should now think twice before using mandated expirations.\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong>\n<\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/12243\/why-mandatory-password-expirations-dont-make-sense-anymore\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#Why Mandatory Password Expirations Don\u2019t Make Sense Anymore \u2013 CloudSavvy IT&#8221; Vitalii Vodolazskyi\/Shutterstock.com Mandatory password changes on a regular timeframe are a fact of life within many organizations. This age-old practice is upheld by proponents as a good baseline security measure to mitigate the risks of password loss. But is it still relevant decades after&#8230;<\/p>\n","protected":false},"author":1,"featured_media":286557,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/06\/c8fec137.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-286556","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/286556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=286556"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/286556\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/286557"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=286556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=286556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=286556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}