Re: Current Best Practice regarding Password Change policy

[Jason Testart <jatestart () UWATERLOO CA>]

  On 9/24/2010 8:52 AM, Valdis Kletnieks wrote:
> (Anybody want to publicly admit they were able to sell the auditors
> on what Spaf said, and managed to eliminate mandatory changes?)

We are about to introduce mandatory password changes here, after a 
recent audit.  The Spaf arguments didn't fly with our auditors, so the 
best I could do is set a standard of a year by default, and 126 or so 
days (one academic term) for more sensitive areas.  That's what we're 
going to do.

The way I see it:

   Compliance 1, Security 0