Question

After experiencing a company wide breach, the IT department revamps its password policies to bolster security by implementing a process that forces employees to create a new password every 90 days. What password management practice facilitates this change requirement?

Answer 1

The password management practice that facilitates the requirement for employees to create a new password every 90 days is known as **password expiration**. This practice mandates that users change their passwords at regular intervals to reduce the risk of unauthorized access due to compromised credentials.

Additionally, to support this practice and enhance overall security, the IT department should also implement related measures such as:

1. **Password Complexity Requirements**: Enforcing rules that require passwords to meet certain complexity criteria (e.g., length, use of special characters, numbers, and a combination of upper and lower case letters).

2. **Password History**: Preventing users from reusing a certain number of previous passwords to ensure that they create unique passwords each time they change them.

3. **User Education and Training**: Providing employees with guidance on creating strong passwords and the importance of regularly updating them.

4. **Multi-Factor Authentication (MFA)**: Adding an additional layer of security beyond just the password, so even if credentials are compromised, unauthorized access is still mitigated.

Implementing these practices in conjunction with password expiration can significantly strengthen an organization's security posture.