Who loves changing their password for work? Except for some lucky souls in Auckland (thanks to the excellent work of @lara), this is the reality every 90 days for much of the New Zealand health system.
- 30 days
- 90 days
- Yearly
- Never (lucky soul!)
As we are human beings, we don’t cope well with this. To mitigate the cognitive load, we tend to go for an easy-to-remember password that we eventually get to comply with overly restrictive character rules (usually communicated poorly), and append a nice little ‘1’. Every three months we simply add one to the digit at the end. For example:
- DHBsRock!1
- DHBsRock!2
- DHBsRock!3
- DHBsRock!4
- DHBsRock!5 and so on and so forth
The New Zealand Advice
CERT NZ recommends the following (emphasis mine):
1. Ask your staff to set strong and unique passwords instead of asking them to change their password regularly
Asking staff to change their password regularly is counterproductive to good password security. People choose weaker passwords when they know they have to change them often. For example, they might simply change their password from Password1 to Password 2. Instead, ask them to create one long, strong and unique password for their account.
If your system currently prompts staff to change their password on a regular basis, change the setting. Staff should only have to change their password if you suspect their account, or the business network, might be compromised in some way.
from https://www.cert.govt.nz/business/guides/password-policy-for-business
The UK: Very Similar Advice
This is from the National Cyber Security Centre:
Don’t enforce regular password expiry
Regular password changing harms rather than improves security. Many systems will force users to change their password at regular intervals, typically every 30, 60 or 90 days. This imposes burdens on the user and there are costs associated with recovering accounts.
Forcing password expiry carries no real benefits because:
- the user is likely to choose new passwords that are only minor variations of the old
- stolen passwords are generally exploited immediately
- resetting the password gives you no information about whether a compromise has occurred
- an attacker with access to the account will probably also receive the request to reset the password
- if compromised via insecure storage, the attacker will be able to find the new password in the same place
Instead of forcing expiry, you should counter the illicit use of compromised passwords by:
- ensuring an effective movers/leavers process is in place
- automatically locking out inactive accounts
- monitoring logins for suspicious behaviour (such as unusual login times, logins using new devices)
- encouraging users to report when something is suspicious
from https://www.ncsc.gov.uk/collection/passwords/updating-your-approach
The US Approach
Fairly typically for the US, these are buried in a very long document by the National Institute for Standards and Technology (NIST).
Fortunately, I found a nice summary of their 2021 password change advice:
2- Remove periodic password reset requirements.
This is one of the biggest frustrations for employees who are forced to change their passwords multiple times per year. Studies have shown requiring frequent password changes is counterproductive to good password security because people will choose weaker or common passwords if they are forced to change their password regularly. They tend to make simple, predictable changes — and bad actors quickly learned those patterns.
Microsoft also agrees that there is no point in forced password changes and will be removing that recommendation from its security recommendations.
If your organisation still enforces mandatory password changes, please consider approaching your CIO and discussing this with them.
