Earlier this month, Microsoft issued an exciting announcement regarding passwords. Now, “exciting” and “passwords” aren’t two things that normally find themselves together in the same 
sentence. However, this news is the most significant change in Microsoft’s password policy recommendations in nearly three decades. In a recent blog post, Microsoft announced plans to remove regular mandatory password changes from its recommended security baselines.
Microsoft didn’t mince words in the post either. Aaron Margosis, the author and a principle consultant with the tech giant, dubbed regular password changes as an “ancient and obsolete” policy. Margosis’ words are harsh considering the policy is one Microsoft has long championed. However, they are also very much in-step with the industry’s current direction. In fact, mandatory password resets have been looked down upon by cyber security experts, standard-keepers such as the National Institute of Standards and Technology (NIST), and more for quite a while.
Why the about-face from Microsoft? Well, the company’s reasons align with the points others have made. Perhaps most notable is that regular password changes do little to make user accounts safer. Actually, they achieve just the opposite. Forcing users to reset their password every 60, 90 or however many days can encourage bad habits. Instead of developing long, complex passwords that randomly mix letters, numbers, and symbols, users may opt for a more familiar pattern. One that is easy to remember and easy to tweak after XX number of days. Usually that also means it will be easy for cyber criminals to crack. Or, in order to remember their constantly-changing, highly-complex password, they may write it down and keep it nearby, yet another worst practice.
Elsewhere in his post, Margosis pointed out another flaw in the logic behind mandatory password resets. He noted that forcing password changes is only helpful in the event that a password is compromised during a given period – and security knows about it. However, if that happened on day 37 of a 60 day cycle, it’s doubtful anyone would wait another 23 days until it expired to change a password. Ideally, it would be changed immediately. After 60 days, if a password hasn’t been compromised, what would be the point of changing it really be? As he concludes, if there’s little benefit to changing an uncompromised password, but there are negatives (see above), than the old model does more harm than good.
There are a few other items worth noting from the post. Microsoft isn’t tinkering with any of its recommendations regarding password length, history or complexity. It’s also sticking to its guns about the benefits – and there are many – of multifactor authentication (MFA). The new passwords directives don’t extend across the Microsoft spectrum, as mandatory resets will continue to be the default in Windows Server versions.
Life after mandatory regular password changes
So, if mandatory expirations are no longer part of a complete password security posture, what is? Here are a few items from Microsoft’s post and our experts:
- Leverage the aforementioned MFA to validate the identities of those trying to log on to the corporate network
- Ban notoriously weak or easily-guessed passwords, e.g., password and any variation of that
- Monitor for attacks in which cyber criminals try to guess credentials using huge volumes of passwords
- Be on the alert for impossible or even simply out-of-character login attempts and be ready to follow up as needed
Next Steps: Secure your network against unauthorized access
Want to learn more about Microsoft’s revised password guidance and the steps your organization can take to keep user identities secure? Visit https://www.arrayasolutions.com//contact-us/ to connect with our in-house teams of experts. They can provide additional insights into this news and help you audit and, if necessary, enhance your security posture.
We want to hear from you! Leave us your comments on this or any of our blog posts via social media. Arraya is on LinkedIn, Twitter, and Facebook. After you’ve shared your two cents, follow us to stay up to date on our industry insights and exclusive learning opportunities.
the Midwest or somewhere more local, the lure was the same: a day of deep dives into the latest innovations, presented by Arraya’s engineers. Presentations covered cyber security, data center, cloud, and much more. The topics were diverse. However, at the core of each, was the “by techs, for techs” spirit that has long defined the event.
Mattison also spent a portion of his keynote dissecting how to succeed as a leader and how those parameters have changed. “With good leadership, everything else falls into place.”
chance to connect with, and learn from, each other. “We’re all in the same boat here,” said Arraya CTO David Bakker. “We’re all techs, so talk to your peers and your teams at the different tables. Everyone is here to learn and have a good time.”
Following in the footsteps of VMware’s other industry-rattling cloud partnership, VMC on AWS, Azure VMware Solutions brings together two of the IT world’s giants. In doing so, VMware and Microsoft have given customers a way to continue using the VMware tools they already know even as their environments become more diverse, stretching from on premises and across multiple clouds.
ever, admins will have the option to protect their VMware virtual machines in AWS by way of RecoverPoint. Given the sustained enthusiasm they’ve encountered surrounding this topic, our Data Center engineers deemed it worth covering more closely.
up with this steady stream of updates can be a lot to ask. Arraya’s Workspace team gave us their expert perspective on some of the most noteworthy features that have come to OneDrive recently and why they’re worth taking time to activate.
a truly hybrid solution. Additionally, VCF can be deployed in the cloud and leveraged as-a-service or it can be rolled out on premises, depending on an organization’s needs.
Technologies World. Kicking off on April 29 and running through May 2, Dell’s global showcase was packed with announcements around what’s new and what’s next from the tech giant. Arraya was well represented at this year’s event and – now that our attendees have had time to digest what they experienced – we sat down with them to recap Dell Technologies World’s most need-to-know announcements.
how much has changed since that day back in 1999. Professionally and personally, our lives are so much different now. Through it all, Arraya has been a constant. I honestly couldn’t be more proud that, after 20 years in the always-evolving, often chaotic world of IT, Arraya is still standing, still helping our customers solve problems and still growing!
When David and I started out, we called ourselves D&D Consulting. Now, that early branding drew from our first initials and not a shared love of roleplaying games. Still, it inspired its share of jokes. Maybe unbelievably, it took David and I three years to think better of that particular decision and rebrand. After an exhaustive search, we eventually settled on the name that would come to define our upstart company: Arraya Solutions.
the transition may not be quite so easy. Even users who leverage similar voice-activated functionality in their personal lives may still have