Password Expiry Ineffective, says Cyber Expert

Employing automatic password expiry for security purposes is no longer effective and can lead to increased costs, reduced production and vulnerable accounts, says the National Cyber Security Centre.

Blogging on the NCSC’s website, a representative of the security group, ‘Emma W’, wrote that password expiry has become:

“…a blunt instrument that casts a long shadow over organisational security.”

She added that while changing passwords on a regular basis may, on the face of it, appear to be a practical way of enabling increased security, evident exists that the cons outweigh the pros by some distance.

There is a greater chance that regular changing of passwords will encourage less secure practices, such as choosing weaker passwords, noting them down on paper, using them across more than one system and only modifying them slightly, such as adding a symbol or number.

Emma W wrote on the blog:

“Password expiry might initially look like a quick and easy way of helping to manage the risks. However, it rarely delivers the headline benefits it promises, and mostly just creates fresh vulnerabilities instead.”

Passwords have become the bane of many an existence, with new website users being forced to create more complicated ones. The security behind it is increasingly important, however. This is especially the case in business, where data kept behind passwords is often held on thousands of customers, if not more. This is just one example of why creating cyber security jobs in order to enlist trained professionals is so vital to today’s business. Most firms are simply unaware of the basics.