How does changing your password every 90 days increase security?
What are best practices for password expiration policies?
There are some questions that already address this issue:
But they seem to be very heavy on anecdotal evidence, and very light on definitive answers.
The general list of arguments for and against password expiration policies seems to boil down to (as listed in the relevant IT Security Blog post):
- To mitigate the problems that would occur if an attacker acquired the password hashes of your system
- It prevents people who use the same password for everything from getting your system compromised if their password is figured out somewhere else
- Compliance reduces the risk of penalties of non-compliance (thanks @AviD)
- By resetting password every X days we are telling the user – Hey, this is important and it should not be taken lightly
- Your password, and the attacker’s guess at your password, are independent. The probability that the attacker’s next guess is correct is the same even if you change your password first.
- Nothing encourages passwords on post-its quite like frequent expiration, especially if there are also high complexity requirements
- It annoys users
- They end up having to work out a new password – which research shows is often is derived from the previous one in a way that is very easy to crack nearly half the time
- You can expect additional support costs to cover users who have forgotten
These lists make good sense, and are excellent conversation fodder among IT professionals. But where do the pros and cons meet in the middle as a "best practice?"
I am interested in the conclusions from studies on the topic, as opposed to personal opinion and anecdotes.