Re: Password expiration - was Re: [SECURITY] Security Awareness Programs

[Chris Green <chrisgreen () GSU EDU>]

On Apr 3, 2014, at 11:16 AM, Roger A Safian <r-safian () northwestern edu> wrote:

> > And in another couple of months that will all happen again
>
> Personally I think that forced frequent password changes do more harm than good.

One other parameter to consider:  Windows systems by default in AD cache the last 10 credential pairs for network 
not-available scenarios.  These can be attacked.  Expiring passwords (and reducing the count) helps minimize collateral 
damage.   There are better controls for password management for this issue but letting a single auth on a forgotten 
device expose you to forever risk is the use-case that made me pro-expiration (and privileged account management expire 
after use).  Unfortunately, the windows-ish way to deal with this risk was smart cards.