Many cybersecurity and IT professionals have been enforcing password rotation policies with their users in Active Directory for the last decade or longer. Password rotation policies have been adopted widely across industries and countries around the world.
But now there is debate about how effective these rotation policies are, whether or not they merit the cost associated with them, and if they are even necessary (with some of the more modern authentication technologies available).
As a result, organizations are moving away from password rotation policies because of cost, complexity, and for better security.
Costs
Many users find these forced password rotation policies frustrating because most users have, on average, over 90 different online accounts that require passwords. So changing them periodically is disruptive to them getting their jobs done.
Lost time is also a significant factor. A survey by Onelogin found that an organization spends an average of 2.5 months a year on password resets alone. The costs aren't just the IT Help Desk, but also from the lost productivity of the employees who have forgotten their password. A password study by HYPR found that 78% of people had to reset a password they forgot in the past 90 days. This time lost to password resets is estimated to cost companies $420 per employee in lost productivity per year, according to a study by Widmeyer/Centrify.
What happens when an employee can't remember their password? They often have to reset it using the IT Help Desk at work. Forrester cites that it costs $70 of IT Help Desk labor for a single password reset. When you consider that 20%-50% of all Help Desk calls are for password resets, it's easy to see how it can get expensive quickly.
Security
With 90+ accounts that require passwords, users are frustrated at the excessive amount of passwords they need to remember. They are further frustrated when they have to change their password regularly, so they take shortcuts. This usually means using passwords that are similar to their previous password, common passwords or context-specific passwords. These weak passwords are a threat to an organization's security.
In 2019, Microsoft recommended against password rotation policies (otherwise known as password expiration policies). “Password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers which are closely related to each other,” Microsoft said in its recommendations. “In these cases, the next password can be predicted based on the previous password. Password expiration requirements offer no containment benefits because cyber criminals almost always use credentials as soon as they compromise them.”
The US-Based National Institute of Standards and Technology (NIST) had similar sentiments in the NIST password guidelines (NIST 800-63), which clearly recommend against password rotation policies. Other organizations are starting to look at the data as well and may soon revise their guidelines.
In today’s environment, password rotation policies can encourage poor password hygiene.
Screen Passwords
NIST password recommendations outline that passwords should be checked against a continually updated list or database of exposed passwords regularly. Daily screening is vital because a password may be safe when it is created, but it can become exposed later.
The premise is that unless an employee's password is found to be compromised or in a password cracking dictionary, they shouldn't have to change their password. Users won't have to continually create and remember new passwords, which allows them to choose a more secure password. If a user's password does become compromised, they can be prompted to change it.
In this way, the company benefits from users having more secure user passwords and with dramatically fewer password resets, the IT Help Desk costs decrease considerably.
Kristen Ranta-Haikal Wilson is a co-founder and CMO of Enzoic. She is responsible for linking cybersecurity and identity-theft product innovation to a comprehensive go-to-market strategy. Prior to Enzoic, she has held diverse roles in marketing and product management at CA, Rally, SSA Global, Oracle, Siebel Systems, and Black&Decker over the course of her 20+ year career.
