Repository navigation
Replies: 1 comment 1 reply
|
I'm not familiar with the STIG specifications (I just know of them), but I don't think not allowing users to change their passwords is a good measure. There are legitimate cases when users may need to change their passwords repeatedly, especially if they believe their password may have be compromised. Changing the password if something suspicious has happened is good security hygiene. If the purpose is preventing circumvention of password reuse policies, I would instead recommend implementing an additional password history mechanism that keeps passwords for a set amount of time (e.g., This point will of course not apply when external security baselines (e.g., STIG) are mandated, but password change policies (especially those that require periodic changes) are no longer being encouraged since it has been proven that some users will go for patterns that make guessing pretty easy (e.g., |
|
I forgot to mention that it may be worth monitoring for password changes and sending alerts if excessive resets occur (e.g., more than 2 or 3 in a day), since this could seen as suspicious behavior - e.g., the user attempting to circumvent policies (in which case the security team should reiterate on security training), or an attacker trying to lock the user out of their account. |
Uh oh!
There was an error while loading. Please reload this page.
Starting this thread to discuss adding a minimum password lifetime policy. Keycloak supports password expiration and history, but does not restrict how soon users can change their password again.
Proposed behavior:
Examples:
This would support security requirements such as ASD STIG V-222544.
Let us know your thoughts.
All reactions