As an IT manager, one thing that’s always driven me nuts is the fact that the password policy generally regarded by folks in the industry as “best practices” is actually pretty far from it.
Via Instapundit, this article about Sarbanes-Oxley compliant password policies being pushed by auditors is a breath of fresh air. Â My preferred policy would be infrequent password changes, combined with regular password cracking to root weak passwords out of the network. Â You do have to impose some degree of complexity in the password, otherwise people will pick ridiculously stupid passwords. Â But some IT people go to ridiculous lengths, and frequent password changes only compound the problem. Â The writing down or saving of passwords on the network is a far greater risk than the risk that someone will crack or guess your passwords. Â All this “security theater” about complexity and duration of passwords might make auditors feel good, but it does you no good if everyone is tacking their passwords under their keyboards. Â If I feel pretty good that a user has picked a good password he or she remembers, I don’t have a problem letting them keep it for a while. Â If you’re an IT manager responsible for network security, you should be trying to crack your users passwords on a regular basis.
