About Us | Contact Us
View Cart

The Password Manifesto Revisited

By Dan Hadaway | Tuesday, May 19, 2015 - Leave a Comment

Password aging should be retired, usually . . .


There is never 100%, even in manifestos!
Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


ServIcons_ITAudit_01

So several years back I became known as the auditor who had the audacity to propose that Password Aging was an aged control.  If you don’t know what I mean by password aging, you  could read that article.  But know by the end of this article you’ll have a very good understanding of “aging as a control.”

Since that manifesto, audit Clients everywhere would rejoice as we suggested they tighten other password management controls and then consider lengthening their aging requirements.

That was then.  This is now.

And I still stand by the entire philosophy.   With a twist though.

The twist is really a reminder.  I said “sometimes.”  The twist is this:  Password Aging can sometimes still be an effective control.

More importantly, let’s be teaching our users that password resets should be triggered, not periodic, and in some cases password aging is still an effective control.

Let me explain:

I still maintain that requiring people to change their passwords only increases the likelihood they’ll fight the system, write it down, or whatever.  And now that we all know how to use very strong passwords, pass phrases, and random password generators, the need to change passwords to protect against CRACKING does not justify the cost.

When I heard about the Anthem breach, I did not need to change all my other passwords because I didn’t even remember my Anthem password.  It was not a “theme password,” meaning that it did not have any core passwords (if you’re still not following me you really need to toss in the towel and read my original article.)  I am very organized about my passwords so I knew that, from an authentication perspective, the Anthem breach did not compromise all my other passwords.

However, I did use, a few years back, a certain “core” for my “entertainment” passwords.  Thus, when StubHub was breached, I had to change my password on Ticketmaster, whitesox.com, and the Todd Rundgren website.  Since then I started using random passwords and thus the second time Ticketmaster was breached was only the second time I had to change the password there.

The point being is that the need to change your password is a “triggered need.”  It should be caused by you remaining aware of the health of the systems you have placed confidential information, and if you think somebody has compromised your password, change it.  If you hear that a system was compromised and the password you are using there, or any part of it, may have been compromised, change that password.

Is there still a good use for “password aging” . . . . periodic required password changes?  Yes!  My mother is a bit trusting of people, and has twice now fell pray to credit card pretext calling scams.  So we now change her credit card number bi-annually.  More instructive, we also change our own credit card at infotex once per year.  The security benefits of this are still probably low, but the non-security benefits (that our contracts don’t auto-renew because our credit card has changed) is still worth the effort.

And to protect against bad threat intelligence (you not hearing about the breach of a system that has passwords you use in other systems), password aging is an  effective control.  So a balance needs to be stricken between the cost of changing your password every 42 days and the risk of not changing your password ever.

The point being is that there is never 100% in security.  That’s why we work in layers of controls.  If you’re using the same password everywhere, 42 days is probably too long now that the companies who ignored security are being hacked.  But if you are using strong passwords, unique to each asset, and you are watching the breach news . . . . your aging can be as long as six months, in this auditors’ opinion.

The title of my manifesto is Sometimes Say Never.  Yes, in general password aging is not an effective control.  But in specific situations, it still makes sense.

And password aging makes a great illustration of how the strength of, and need for, any individual control depends greatly upon the entire control structure.


Original article by Dan Hadaway CRISC CISA CISM. Founder and Managing Partner, infotex

“Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”

 


same_strip_012513


 

Latest News
    A follow-up on Dan’s 2008 Password Manifesto On the NIST Publication on Digital Identity Guidelines Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . In June 2017, NIST released a special publication on digital identity, NIST SP 800-63, that is starting to get the attention […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    Over Seven Billion Usernames Have Been Leaked in Breaches Since 2011… An article review. An unfortunate fact of modern life seems to be the inevitable announcement of new data breaches, and if you’ve lost track of how many breaches you’ve had to perform a risk assessment on you’re probably not alone…but just how much personal […]
    Or, the risk of email hypnosis . . . And the other implications of complacency! Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Now that the pandemic is coming to an end, most of us are returning to our daily commutes.  Are you finding […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office.  
    Machine learning is here to stay, so how do we assess its risk? An article review. When it comes to assessing technology risk, there seems to be as many methods as there are attack vectors… but what happens when an entirely new field opens up?  When it comes to machine learning (ML) there aren’t many […]
    You’ve heard it from every MSSP you’ve met: the definition of a SIEM is in the eye of the beholder. But at infotex, we are not talking about the database – an asset whose definition is continuously evolving. We’re talking about the way three teams collaborate in an overall Technology Risk Monitoring process. And whether […]
    A new study shows organizations are responding to cyber attacks faster than ever, so why is that bad news? An article review. When it comes to cyber attacks, the sooner an organization can begin to respond to an attack the better, so the results of a new study showing a drop in the amount of […]
    …a Crash Course of Security Measures The first article by Sara Fultz, Creative Assistant of infotex! Introduction: As the managing partner of infotex, I am proud to introduce the “debut article” for Sara Fultz.  I told Sara “write an article showing us what you’ve learned that the technical staff will appreciate.” As I read her […]
    infotex Programming Coordinator, Michael Hartke, introduces a high level overview of the upcoming update to the infotex SIEM. Look for more movies in the coming months informing our Clients, and those just now learning about us, about the SIEM and its features and functions.