As it stands today, it takes an organization, on average, 207 days to identify a breach (Ponemon Institute, 2020). While forced password changes can cause problems, not requiring users to change their passwords can also cause problems. In one such study, researchers found that they were able to guess 41% of user's current passwords within three seconds if they knew the user's previous password. Similarly, if monthly password changes are required, a user might incorporate the name of a month into the password and then change the month every time a password change is required (for example, is even more disturbing is that studies have proven that it is often possible to guess a user's current password if you know their previous password. A user might, for example, append a number to the end of their password and then increment that number each time that a password is required. When a user is forced to change their password, they will often come up with a new password that is based on their previous password.
Humans are notoriously resistant to change. Microsoft password reset recommendationsĪccording to Microsoft, requiring users to change their passwords frequently does more harm than good.
Organizations are being forced to consider, perhaps for the first time, whether or not requiring periodic password changes is a good idea. Microsoft has reversed course on the best practices that it has had in place for decades and no longer recommends that organizations require users to change passwords periodically. Recently, however, things have started to change. In fact, the need for scheduled password changes may be one of the most long-standing of all IT best practices. For as long as corporate IT has been in existence, users have been required to change their passwords periodically.
0 kommentar(er)
