À quelle fréquence les stratégies IAM doivent-elles obliger les utilisateurs à modifier leurs mots de passe ?

The primary rationale behind regular password changes lies in enhancing our organization's cybersecurity posture. Proactively changing passwords serves as a fundamental defense mechanism against evolving threats such as phishing, malware, and data breaches. By doing so, we minimize the risk of unauthorized access, limit potential damage, and align with regulatory and organizational standards. This practice is essential to staying ahead of cyber threats and safeguarding our digital assets.

The security best practices to be followed for an organisation will depend on various factors such as organization's culture ( risk averse or prone) , industry operating in, regulatory requirements etc. Basis these factors, the security baseline and best practices are defined. Similarly there's no fixed frequency of changing password as that as well depends on above mentioned factors. However some of the prevalent practices organisation follow are - 1. Password to be changed on first logon and same is communicated by a secure means. 2. Password are set to expire defined intervals. 3. Password to be changed incase of any incident or if there's doubt of leak or compromise. 4. If someone with knowledge of shared password leaves the firm etc.

Password change rules should be based on to: -regulatory requirements -information sensitivity -organizational risk appetite ⚠️ Seen in the wild: Frequent password change requirements can lead to users writing passwords down

The frequency at which IAM (Identity and Access Management) policies should require users to change passwords depends on various factors, including organizational security requirements, industry regulations and risk tolerance. However, here are some general guidelines: 1. Set password change intervals at 45 to 60 days for a balance between security and usability. 2. Consider more frequent changes for privileged accounts and sensitive data access. 3. Ensure compliance with regulations like PCI DSS or HIPAA regarding password change requirements. 4. Adapt policies based on user behavior and emerging threats to maintain a strong security posture.

Mi recomendación es si puede ir hacia sistemas sin contraseña. Algunos proveedores por ejemplo Microsoft ya ofrece soluciones sin contraseñas tanto para usuarios como para cuentas de servicio (GMSA). Si necesita contraseñas, al menos debe asegurarse de combinarlas con otros sistemas como MFA, sistemas biométricos y sobre todo cambiarlas de forma regular, esto evitará compromisos de identidad y reducirá el tiempo que un atacante puede preparar su compromiso. Contra menos tiempo los atacantes dispongan de identidades menos elaborado será el ataque.

Go for passwordless if possible and password change depend on types/tiers of accounts. There is one specific NIST document which talks about password best practices.

Increased burden on users: Frequent changes can be inconvenient and lead users to choose weaker, easier-to-remember passwords that defeat the purpose. Limited effectiveness: Studies have shown mandatory changes don't significantly improve security compared to focusing on strong password creation and other measures. Risk of password reuse: Users may simply cycle through variations of the same password, negating the security benefit.

Encourage users to change their passwords regularly, typically every 60 to 90 days, to reduce the risk of unauthorized access. This is a tried and tested approach Enforce a strong password policy that includes requirements for length, complexity Educating users on creating strong passwords, recognizing phishing attempts, and understanding the importance of password security.

La seguridad es una balanza que se invierte normalmente con la productividad. Los sistemas mas seguros suelen ser complejos y requerir mas tiempo para realizar operaciones, no obstante el beneficio de evitar un incidente de seguridad es muy alto y compensa los inconvenientes de los usuarios. Todo sistema bajo contraseña debe cambiarse de forma recurrente, si a sus usuarios les genera problemas puede adquirir productos que auto generen las contraseñas y sobre todo asegúrese que sus usuarios almacenan esas contraseñas en repositorios seguros, un VAULT de un sistema cifrado es una buena opción. Evite en la medida de lo posible ficheros keepass que pueden ser copiados y vendidos en darkweb.

Changing passwords too often may diminish user productivity, escalate support costs, and foster poor password habits. Users struggling to remember or manage frequent password changes might resort to risky behaviours like writing them down or using weak passwords, undermining the very purpose of the policy. Moreover, frequent password changes might not effectively counter certain attack vectors such as keyloggers, session hijacking, or credential stuffing.

In my experience, the main factors to determine frequency will depend on environment maturity, regulatory mandates and industry specific best practices. For sure we cannot rely on passwords only but rather MFA and Biometric login nowadays are becoming defacto.

The frequency of password changes in IAM policies should strike a balance between security and usability, tailored to the organization's risk tolerance and security requirements. While periodic changes are important to mitigate the risk of unauthorized access, excessively frequent changes can impact user experience without significantly enhancing security. It's crucial to reassess IAM policies regularly, considering factors such as data sensitivity, likelihood of password compromise, and effectiveness of other security measures, to ensure alignment with evolving threats and industry best practices.

The goal of requiring regular password changes is to minimize the risk of unauthorized access due to compromised credentials. However, organizations should balance security requirements with user convenience and usability, as overly frequent password changes can lead to user frustration and potentially weaken security if users resort to predictable or easily guessable passwords.

One every year or 2 years is the best if you use 2FA and one password manager with a hardware key, change the password with more frequency only increase the possibility to forget it

En mi experiencia las contraseñas de usuarios deben cambiarse entre los 30 y 45 días. Las contraseñas de cuentas de servicio o tareas programadas deberían cambiarse una o dos veces al año. Y las contraseñas de cuentas compartidas deberían cambiarse tras cada uso.

IAM Password Policy settings: Use AWS IAM's built-in policy settings to: Define minimum password length, character diversity, and prohibited patterns. Allow users to change passwords (optional). Set password history to prevent reuse. IAM Identity Provider: Leverage features like password expiration and complexity requirements. MFA: Implement multi-factor authentication for an extra security layer. Education and awareness: Train users on password hygiene and best practices.

To implement periodic password changes, utilize IAM software or services enabling customization of password expiration dates, complexity standards, history restrictions, and notification settings. Choose IAM platforms or frameworks that seamlessly integrate with existing applications and systems, ensuring centralized and consistent password management. This integrated approach not only enhances security but also streamlines the enforcement process.

Enforce password complexity rules that require a minimum length and a mix of uppercase, lowercase, numeric, and symbolic characters. This makes passwords harder to crack or guess by brute force or dictionary attacks. Allow users to change their own passwords, but also monitor and audit password changes for any suspicious activity. This gives users more control and convenience over their passwords, but also allows administrators to detect and respond to any potential breaches.

IAM software always has a policy module where you can implement the behavior of the system when a password is old or weak. Please, use it and educate your users. It is no costly and it will give you very good outcomes.

Intente integrar en un mismo sistema sus cuentas y evitar tener diferentes repositorios, de esta forma podrá unificar políticas y criterios. Por ejemplo puede federar servicios con SAML y de esa forma autenticar muchas aplicaciones con Azure AD/Entra o integrar sistemas en Active Directory. Para sistemas no Windows IDM de redhat es una buena opción.

The most important thing to monitor is not your password policies, but compromised credentials (passwords) and password reuse. To monitor compromised credentials, you can use dark web monitoring, breach notification, and ATO protection services. To monitor reused passwords, you can use enterprise reporting from your password manager, which should include reports like users with reused or similar passwords across multiple websites, compromised passwords, simple passwords, and accounts without 2FA. These can be addressed by your identity or enterprise security teams as necessary.

1. SIEM systems collect and analyze log data from various sources, including authentication systems, to detect and respond to security incidents. They can be configured to monitor password changes and alert administrators to any suspicious activities. 2. For Windows environments, Active Directory provides built-in auditing features that can track password changes, including the username, date, and time of the change. Administrators can enable auditing policies and review audit logs periodically. 3. PWD Management Solutions: Some password management solutions offer auditing capabilities to track password changes across an organization's systems and applications. These solutions can provide detailed reports on password-related activities.

Monitoring can be done with logging such as with a SIEM and ensuring policies are in place to alerts. Additionally, password and logging policies should be establish in a written form, reviewed, and signed off by leadership for enforcement. AD is a great tool for enforcing password policies. Reoccurring audits of password and logging controls are considered best practice for ensuring your organization aligns with industry standard security best practices.

In my experience, ensuring the effectiveness and appropriateness of password policies requires regular monitoring and evaluation. Leverage IAM metrics and reports to meticulously track password-related activities like changes, resets, failures, breaches, and user feedback. I suggest incorporating IAM audits and assessments into your routine. These evaluations verify and validate password policies, identifying any gaps or issues that demand attention or improvement. Through consistent monitoring and review, gain insights into policy performance, facilitating timely adjustments and optimizations to meet evolving security and usability goals.

Existen herramientas que permiten evaluar la complejidad de las contraseñas en su creación, se puede configurar el grado de complejidad y recomendar a los usuarios la selección adecuada de contraseñas semi complejas que permitan controlar la administración por aplicación

Here are some additional things to consider Implementation of MFA will add an extra layer of security beyond passwords using methods such as SMS codes, authenticator apps, or hardware tokens. Educating users to store passwords securely using cryptographic hashing algorithms to protect against unauthorized access. Making the password change process intuitive and user-friendly to encourage compliance and reduce frustration. Conducting regular security assessments and audits to identify weaknesses in the password management system would help a lot .

This question is about password change policies, when the reality is, we should NOT rely on passwords alone for authentication. If a password is not complex enough, or is popped via some other means, then it is worthless. MFA should be used EVERYWHERE. Most organizations use O365, and as such, Microsoft Entra is included for FREE. There is ZERO excuses for not using MFA.

Another valuable insight is the impact of user education. Organizations often underestimate the power of robust user training programs. Educating users about the rationale behind password policies, potential risks, and secure practices fosters a culture of cybersecurity awareness. This not only enhances compliance but also reduces the likelihood of password-related issues.

Além de definir a frequência de alteração de senhas, é importante implementar outras medidas de segurança, como senhas fortes, autenticação multifator, monitoramento de atividades suspeitas e educação contínua dos usuários sobre boas práticas de segurança cibernética. Essas práticas complementares ajudam a fortalecer a postura de segurança da organização e a mitigar os riscos de comprometimento de dados.

From the legal perspective of the responsibility of the user (customer) and the company (bank) in terms of the use and protection of passwords. In a scenario of legal dispute between 1) the customer of a Bank who noticed the movement of undue financial balances by someone who obtained the customer's password and 2) the Bank that held the customer's money and that implemented sufficient IS measures. I have seen scenarios in which the court decision was favorable to the customer because the Bank did not demonstrate all applicable IS measures, on the other hand, results favorable to the Bank because the customer would not have been diligent with their password. It is important to pay close attention to the legal consequences of IS practices.