For some reasons that you might want to reconsider this, see:
http://www.cerias.purdue.edu/weblogs/spaf/general/post-30/
and
http://www.smat.us/sanity/expharmful.html
Why do you think a 30-day expiration "is absolutely essential"?
> -----Original Message-----
> From: MSU Network Administrators Group
> [mailto:[log in to unmask]] On Behalf Of Bryan Murphy
> Sent: Tuesday, May 16, 2006 11:47 AM
> To: [log in to unmask]
> Subject: [MSUNAG] Password Expiration Policies
>
> Hi Guys,
>
> I am about to implement a password policy that calls for
> password expiration every 30 days. I have run my policy by a
> small group of faculty and found that this (as I suspected)
> is the only point of contention in the policy.
>
> From a security stand point this is absolutely essential for
> a number of reasons, and I have explained these reasons but
> still get guff.
>
> For some reason stating "department x has this same policy"
> or "x % of the departments on campus already do this" works
> far better than logical explanations... So I was wondering if
> anyone in NAG'Land would mind sharing what they are doing for
> departmental password policies.
>
> Thank you.
>
> ,--------------------------------------------+----------------
> -------------,
> | Bryan Murphy, CISSP |
> [log in to unmask] |
> | Information Technology Coordinator |
> 517.432.5939 w |
> | MSU Plant Research Lab & Plant Biology |
> 517.355.1926 fax |
> | 132a Plant Biology Bldg. |
> http://infotech.prl.msu.edu |
> '--------------------------------------------+----------------
> -------------'
>
|
