What is the recommended expiration for a password reset link generated for a user?
Citations/ links to NIST guidelines and documentation are very much appreciated.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
It depends on how you’re communicating with the client. NIST recommends the following during the enrollment process when it’s considered a part of the authentication process; which I would consider equivalent to the password reset process. Also note these are maximum values, you may certainly use shorter intervals than these.
188.8.131.52 Address Confirmation
[ ... ]
e. Enrollment codes SHALL have the following maximum validities:
i. 10 days, when sent to a postal address of record within the contiguous United States;
ii. 30 days, when sent to a postal address of record outside the contiguous United States;
iii. 10 minutes, when sent to a telephone of record (SMS or voice);
iv. 24 hours, when sent to an email address of record.
Respectfully, your question is missing a couple pieces of information...
You know what's funny about that? I just started with a Silicon Valley tech giant. If you elect to change your password, you have to get approval. First place I've ever worked like that -- every other org has been hypersensitive about password policy. This place is probably on the top 10 of attacked companies in a day an they DO NOT have users change their passwords.
Other technologies and business requirements.
2a. Have you done a risk analysis?
Is there a right or wrong answer to this question? I've seen some orgs implement anywhere from 30 mins to 24 hours for expiration. Who is to say one is doing it better than the other.
Something completely lost in the security world today is one engaging the brain before a checklist. So if NIST, DISA, or some other alphabet soup tells you 24 hours is the answer, you're going to blindly follow that? Why? So you get to brag that you're "NIST-compliant" (whatever that means)?
The reason why I try to get people to ask these questions and have such discussions is because the adversary can go to nist.gov just as easily as you can. When they are doing their recce, they already have some portion of an idea of what to expect as they begin their attack.