However, the password rotation requirement was until relatively recently something that many IT auditors would actually recommend, even though it leads directly to bad user password choices. In fact I wouldn't be at surprised to learn that was still the case in a lot of places.
ReallyLongP@assword$01, ReallyLongP@assword$02, ReallyLongP@assword$03, and so on.
People understandably get really fired up by the idea of not having to change their password every 90 days, but forget that the guidelines are a package that contains a lot of "shall"s (no password expiration is a mere "should") that would be more painful for organizations stuck with a lot of legacy software, like the requirement to use two authentication factors and the use of secure authentication protocols.
Note: I only do this when I have these requirements and I can’t use a password manager.
NIST has very good password complexity and management guidelines. Just USE THEM! It’s not that hard!
How do you have billion dollar companies that can’t RTFM.
On the other, an expert witness has specifically represented themselves to be an expert. Is there any level of incompetence that raises to the level of perjury in that case? IMO there ought to be.
Whether the technique or theory in question can be, and has been tested; Whether it has been subjected to publication and peer review; Its known or potential error rate; The existence and maintenance of standards controlling its operation; and Whether it has attracted widespread acceptance within a relevant scientific community.
The expert does not “know.” The expert is the only witness who can give an opinion, more or less. Because the opinion is backed up by something, the court considers it useful.
The technique they use is what’s important, not whether their opinion contradicts a fact. I think you will find in many expert trials, two experts get the same facts and come to two completely contradictory opinions, neither of which is perjury.
Now there's a positive rule about not doing it.
When the NIST added the bad rule into their ruleset (it was mostly a collection of bad rules at the time), it was already widely mocked in popular culture (well within the target population).
I now wonder if that ruleset (the original one, that basically mandated you copy every flaw on Windows NT) was honest.
"Come to think of it, it's about time to replay Deus Ex again..."
It's good we have 26 letters, that comfortably leaves you a margin of 6 combinations :-)
If your company does forced password updates, they are not following the NIST recommendation: https://pages.nist.gov/800-63-FAQ/#q-b05
If your company is not following the NIST recommendation, they are incompetent, and will be held liable in case of a breach.
They require us to change our passwords every 45 days now. When I pointed out the NIST recommendations of not rotating passwords, they say they are following the guidance of the response team that helped them recover from the ransomware. And that the NIST doesn't actually deal with the real world.
This is a stretch. Liable? Please show the case law, or the legislation.
(My statement has no relevance to the validity of NIST's recommendations)
There are 1000s of such organizations, and many conflict with each other.
My point is, it's inaccurate to say you are liable for not following NIST. I could easily say you could be liable, for not following me.
Does that make it so? No.
Password1
Password2
Password3
Etc
PasswordFebruary2024!
Where month and year update on the date of forced password change.
hunter3
hunter4
hunter5
Password1
Password1
Password1
Etc?
So a hacker can infer that my password is tacokissies69000 of some sort..
Fear of policy is why you get things like "force us to change our passwords every 6 months and block the last twenty". Getting a central arbiter of IT competence is a hard problem.
While I know this may be fruitless, it might be worthwhile to point out to them that the official guidance from NIST and similar organizations is now not to do this.
The IT department where I work required yearly password changes up until I brought this change to their attention, at which point they changed to simply recommending a password change if you have reason to believe it might have been compromised.
Same problem here. My solution: Get a mouse with internal memory for macros, such as Natec Genesis GX78 (old, no longer available, but this is an example). Program your new password on one of the unused mouse buttons or in a different profile. Use the mouse to type the password.
Could make it double as a YubiKey.
Surely this exists already?
No, it identifies as a keyboard. It also defaults to generating a password that will use the same scancodes on (most?) western keyboard layouts so that computers configured to default to e.g. QWERTZ or AZERTY will still result in the same password.
It's very niche, but in those rare situations it'll be a big time-saver compared to human transcription or the rigamarole of setting up some other kind of data channel.
Then I became CTO and retired the policy to align to modern NIST recommendations, so that "18" is in there forever :)
Combined with the fact that the largest single source of spam I'm seeing right now is also coming from random tenant GUIDs .onmicrosoft.com (is Azure really missing that much SMTP security for random M365 tenants?) and this sort of corporate anti-training users to follow bad transactional email links, it certainly feels like we are in a perfect storm of M365 phishing.
Overall when compared to Google's suite of products, M365 just seems so sloppy.
This should be out of the hands of the local IT clowns entirely.
It is interesting how sometimes creating "more secure" measures results on less security. Our IT department decided that using 2fa for vpn is not enough, we should also extra 2fa for connecting to the webmail even through intranet or vpn. Guess who stopped using the vpn.
Meanwhile, one can set up and use our email through any email client app on desktop or mobile without any 2fa at any step. Go figure.
The same guys also force us to change our passwords every 6 months and block the last twenty. Passwords we have to enter in systems that can’t pull directly from password managers and thus have to type 10-20 per day. Guess the average strength of an employee password!
I think IT incompetence should lead to audit fails or even better delisting from exchanges.