Password Aging Policies and Quantifying Security Advantages

Many enterprise security policies enforce “password aging”, i.e., require that users change their passwords each fixed intervals such as 90 days. The apparent justification is that this improves security. However, the implied security benefit has been little explored, and quantified less. We provide a detailed analysis pursuing the question “What security advantage is delivered by password expiration policies?”. We find that the benefits are far less than expected.

Speaker Details

See “Short biography” at http://people.scs.carleton.ca/~paulv/personal.pvo.html

Series:
Microsoft Research Talks
Date:
Speakers:
Paul Van Oorschot
Affiliation:
Carleton University

    • Portrait of Jeff Running

      Jeff Running

Series: Microsoft Research Talks