Security Is a Useless Controls Problem

Re:Security Is a Useless Controls Problem by Jedd on Monday November 11, 2024 @09:23PM (#42112249)

Alas, in Australia one of the more popular frameworks in gov agencies is Essential Eight, and they are a few years away from publishing an update with this radical idea.

[ Parent | on HN ]

Re:Security Is a Useless Controls Problem by NoPicklez on Wednesday November 13, 2024 @12:08AM (#42123082)

My understanding is that Essential Eight doesn't require password rotation

[ Parent | on HN ]

Re:Security Is a Useless Controls Problem by Jedd on Wednesday November 13, 2024 @01:54AM (#42123549)

If so then I'll be doubly frustrated - I've been assured by our domain experts that this is a requirement of the model.

Did it used to be and was since retracted? I suppose it may be a local or state-based 'implementation augmentation'.

I've trawled just now through the signals directorate site and can find plenty of references to passwords, but nothing specifically covering this.

[ Parent | on HN ]

Re:Security Is a Useless Controls Problem by NoPicklez on Thursday November 14, 2024 @06:19PM (#42142339)

It may have been as password rotation was a requirement thrown around, but to my knowledge it's not come up in assessments for a long time.

[ Parent | on HN ]