Re: Password policy

[Gary Flynn <flynngn () JMU EDU>]

Kellogg, Brian D. wrote:

> A couple questions:
>
>
>
>    1. Do most enforce password expirations?  I came from a large
>       corporation and they enforced a 90 day password expiration
>       policy.  It seemed to have the effect of making passwords less
>       secure as most would write them down in obvious places.

We've had a password expiration policy for as long as I can remember.
We went from a 190 day cycle to a 90 day cycle a few months ago to
align our policies with state guidelines.

>    2. Do most enforce a strong password policy?

We enforce password complexity rules, history, and a
rudimentary dictionary check.

>    3. Any other recommendations/insights along this line would be helpful.

I agree with others that writing a password down in a secure
location is an acceptable solution to password proliferation,
change, and complexity.

--
Gary Flynn
Security Engineer
James Madison University
www.jmu.edu/computing/security