There is the current federal password policy:
http://www.itl.nist.gov/fipspubs/fip112.htm
I know that it was published in 1985 but using this standard you are
looking at Department of Defense, they require less. And unless there
is a really compelling reason for 30 days that evolves something like ID
theft or national security, I suggest that you use something a bit more
liberal. Even those of us who have to live under HIPAA, most passwords
are changed more often than 30 days. John Hopkins Hospital's minimum
time-frame is 90 days which also includes a 2 year memory of used PWs.
Linda Losik
HIPAA Security Officer
Health Information Technology
-----Original Message-----
From: MSU Network Administrators Group [mailto:[log in to unmask]] On
Behalf Of Bryan Murphy
Sent: Tuesday, May 16, 2006 11:47 AM
To: [log in to unmask]
Subject: [MSUNAG] Password Expiration Policies
Hi Guys,
I am about to implement a password policy that calls for password
expiration
every 30 days. I have run my policy by a small group of faculty and
found
that this (as I suspected) is the only point of contention in the
policy.
From a security stand point this is absolutely essential for a number of
reasons, and I have explained these reasons but still get guff.
For some reason stating "department x has this same policy" or "x % of
the
departments on campus already do this" works far better than logical
explanations... So I was wondering if anyone in NAG'Land would mind
sharing
what they are doing for departmental password policies.
Thank you.
,--------------------------------------------+--------------------------
---,
| Bryan Murphy, CISSP |
[log in to unmask] |
| Information Technology Coordinator | 517.432.5939 w
|
| MSU Plant Research Lab & Plant Biology | 517.355.1926 fax
|
| 132a Plant Biology Bldg. |
http://infotech.prl.msu.edu |
'--------------------------------------------+--------------------------
---'
|
