usually how long a password will be good?

Question

Don't know where to ask this question. My boss ask me to figure out usually how often to change the password? we are now developing a system requires high security.

EDIT:

I mean how many days before we force user to change password.

Answer 1

Password length is not really so important; provided it's above a certain threshold, complexity is what matters most. You say you require high security so I'll second the recommendation to use something like an RSA fob in combination with a password.

For how often to change it, it depends really. Enforcing a password change is a level of protection against a compromised password that hasn't yet been used. Change too often and you'll only annoy the users (and increase the risk of them writing it down somewhere), change not often enough and you lose that protection. It could be argued that it's of dubious benefit.

More effective against brute force cracking attempts is some form of account lockout. Locking an account for even 30 seconds after 3 successive incorrect passwords will stop a brute force attack dead in its tracks.

Tell us more about the system. Is it internal or external? How sensitive is the data? These are factors which will determine if any recommendation is overkill (or underkill).

Answer 2

See http://serverfault.com/questions/21890/password-expiration-policies for a good discussion.

My opinion is that in most situations, forcing password changes is more "security theater" than real security. Especially more frequently than 90 days.

Answer 3

From my experience, the more you ask a user to change its password, the more the password will end up being written on something and hidden beneath the keyboard, unless their job is actually keeping secret passwords, they have other things to keep think of than to remember a new password every week or month.

As a rule of the thumb, I'd say than more than every other month should do it.

Answer 4

Depends on who wants to break into your data.
If you have no useful data, then 8 characters and and 2 out of 4 (lower case, upper case, numbers, symbols) is probably good.
If you have mildly useful data, then 10 characters and 3 out of 4 is good-ish.
If you have sensitive data then at least 12 characters and all 4 out of 4. You might also consider getting RSA key fobs, or smart cards.

And for further reading on the current state of cracking passwords, read up Cracking Passwords in the Cloud.

As mentioned by someone else, password change time is very subjective. But in general 6 months is a good time frame. Go shorter or long if you feel you need to, you know much more about your network than and of us. Going too short will lead to sticky notes stuck to monitors with passwords. Too long make brute force attacks more feasible (though still very unlikely if you have a good lockout mechanism).

If you run Windows Server 2008 the default security settings are a very good starting point.

Answer 5

In order to obtain a serious security benefit from password changes you need to change them more frequently than they can be cracked. This is of course not practical in the real world, so you need to come up with some arbitrary figure dependent on your own assessment of risk. Just bear in mind that the more often you force people to change their passwords the weaker and more predictable those passwords are likely to be. After all, they need to be remembered and nobody wants to learn a new complex password on a regular basis. It's possible to have a policy that negates that human factor but all you're going to do then is piss off your users, who will start writing those passwords down, which of course defeats the purpose.