I'm asking two very related questions
- As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their password after a certain amount of time but a certain amount of login attempts. For example if 30 incorrect passwords were entered the next time the user logs in they must change their password.
- For situations where I'm not the admin and there is no password expiry how often should I changed the password? For example my cellphone provider doesn't require me to change the password and I haven't for over a year, though the password is quite complex.