<story><title>Microsoft says mandatory password changing is “ancient and obsolete” (2019)</title><url>https://arstechnica.com/information-technology/2019/06/microsoft-says-mandatory-password-changing-is-ancient-and-obsolete/</url></story><parent_chain><item><author>quesera</author><text>That&amp;#x27;s correct. PCI DSS section 8.2.4(a) requires that passwords are changed at least every 90 days.&lt;p&gt;Other requirements from the same section: retain old passwords to disallow dupes for at least 5 cycles, passwords must be minimum 7 chars, and contain both alpha and numeric.&lt;p&gt;You might be able to justify non-compliance with a compensating control, but I&amp;#x27;ve never heard of anyone who tried it.&lt;p&gt;Note that this only applies to employees who are in PCI scope. Most internal staff are not, and should not be!&lt;p&gt;Similar policies are common for all users though. They pre-date PCI (which is how they became part of PCI DSS) and now PCI&amp;#x27;s retention of these policies justifies continued use elsewhere. The tail wags the dog.</text></item><item><author>xxpor</author><text>My understanding is the biggest driver of still having mandatory password rotation is PCI (the payments security requirements, not the bus)</text></item><item><author>kipchak</author><text>I believe this has been Microsoft&amp;#x27;s guidance as far back as 2016, with the caveat of using Azure AD risk analysis &amp;#x2F;MFA.[1]&lt;p&gt;&amp;gt;Password expiration policies do more harm than good, because these policies drive users to very
predictable passwords composed of sequential words and numbers which are closely related to each
other (that is, the next password can be predicted based on the previous password). Password change
offers no containment benefits cyber criminals almost always use credentials as soon as they
compromise them.&lt;p&gt;&amp;gt;Mandated password changes are a long-standing security practice, but current research strongly
indicates that password expiration has a negative effect. Experiments have shown that users do not
choose a new independent password; rather, they choose an update of the old one. There is evidence to
suggest that users who are required to change their passwords frequently select weaker passwords to
begin with and then change them in predictable ways that attackers can guess easily.&lt;p&gt;&amp;gt;One study at the University of North Carolina found that 17% of new passwords could be guessed given
the old one in at most 5 tries, and almost 50% in a few seconds of un-throttled guessing. Furthermore,
cyber criminals generally exploit stolen passwords immediately.&lt;p&gt;[1]&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;research&amp;#x2F;wp-content&amp;#x2F;uploads&amp;#x2F;2016&amp;#x2F;06&amp;#x2F;Microsoft_Password_Guidance-1.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;research&amp;#x2F;wp-content&amp;#x2F;uploads&amp;#x2F;...&lt;/a&gt;</text></item></parent_chain><comment><author>AdamJacobMuller</author><text>&amp;gt; You might be able to justify non-compliance with a compensating control, but I&amp;#x27;ve never heard of anyone who tried it.&lt;p&gt;I just did similarly within a SOC2 audit. I sent the auditors a list of 50+ articles and references i&amp;#x27;ve been maintaining for years saying that password changing is a bad idea (this article is on the list) from many different sources. I never heard back and the item was marked approved by them.</text></comment>
<story><title>Microsoft says mandatory password changing is “ancient and obsolete” (2019)</title><url>https://arstechnica.com/information-technology/2019/06/microsoft-says-mandatory-password-changing-is-ancient-and-obsolete/</url></story><parent_chain><item><author>quesera</author><text>That&amp;#x27;s correct. PCI DSS section 8.2.4(a) requires that passwords are changed at least every 90 days.&lt;p&gt;Other requirements from the same section: retain old passwords to disallow dupes for at least 5 cycles, passwords must be minimum 7 chars, and contain both alpha and numeric.&lt;p&gt;You might be able to justify non-compliance with a compensating control, but I&amp;#x27;ve never heard of anyone who tried it.&lt;p&gt;Note that this only applies to employees who are in PCI scope. Most internal staff are not, and should not be!&lt;p&gt;Similar policies are common for all users though. They pre-date PCI (which is how they became part of PCI DSS) and now PCI&amp;#x27;s retention of these policies justifies continued use elsewhere. The tail wags the dog.</text></item><item><author>xxpor</author><text>My understanding is the biggest driver of still having mandatory password rotation is PCI (the payments security requirements, not the bus)</text></item><item><author>kipchak</author><text>I believe this has been Microsoft&amp;#x27;s guidance as far back as 2016, with the caveat of using Azure AD risk analysis &amp;#x2F;MFA.[1]&lt;p&gt;&amp;gt;Password expiration policies do more harm than good, because these policies drive users to very
predictable passwords composed of sequential words and numbers which are closely related to each
other (that is, the next password can be predicted based on the previous password). Password change
offers no containment benefits cyber criminals almost always use credentials as soon as they
compromise them.&lt;p&gt;&amp;gt;Mandated password changes are a long-standing security practice, but current research strongly
indicates that password expiration has a negative effect. Experiments have shown that users do not
choose a new independent password; rather, they choose an update of the old one. There is evidence to
suggest that users who are required to change their passwords frequently select weaker passwords to
begin with and then change them in predictable ways that attackers can guess easily.&lt;p&gt;&amp;gt;One study at the University of North Carolina found that 17% of new passwords could be guessed given
the old one in at most 5 tries, and almost 50% in a few seconds of un-throttled guessing. Furthermore,
cyber criminals generally exploit stolen passwords immediately.&lt;p&gt;[1]&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;research&amp;#x2F;wp-content&amp;#x2F;uploads&amp;#x2F;2016&amp;#x2F;06&amp;#x2F;Microsoft_Password_Guidance-1.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;research&amp;#x2F;wp-content&amp;#x2F;uploads&amp;#x2F;...&lt;/a&gt;</text></item></parent_chain><comment><author>briffle</author><text>Yep, Its very secure, because nobody would use:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    P@ssw0rd!
    P@ssw0rd!2
    P@ssw0rd!3
    P@ssw0rd!4
    P@ssw0rd!5&lt;/code&gt;&lt;/pre&gt;</text></comment>