is to help backstop your access removal process.
If your system is configured to lockout an account after the password has expired, then this will help you clean up accounts that should have been terminated but weren't. For instance, if an employee transfers to a different job and the access removal request is never submitted by the "losing" manager, then a password expire policy will help guarantee that the employee's ccount cannot be abused.
Also, from the hacker/trojan point of view, how many scripts are smart enough to recognize a "change your password" prompt and take the required actions, and then remember what the new password is, system by system? Granted, they could be updated to include that functionality, but I don't think they do it right now. So, it does provide a mitigating factor to root hacks, etc.
--
merlin |
