Why do we have to rotate our passwords every 90 days?

[jordanpadams]

I just got an email that we have to reset our passwords every 90 days. Why is that?

[jimmie]

Mandatory password changing was historically a NASA cybersecurity requirement. In recent times however this mandate has been eased and is no longer a strict requirement as the reliance on multi-factor authentication and other digital means of authentication have become more prevalent in the NASA realm. Despite no longer being absolutely necessary, PDS requires a password change every 90 days in order to ease the window of exposure for unauthorized access due to compromised credentials. One counter argument to this is that requiring a different password on a routine basis encourages the use of weak, predictable passwords. However, PDS does impose certain requirements on the password value (e.g. 8 character minimum, use of upper/lower characters, numerics and at least one special character) which greatly reduces the likelihood of password guessing on the part of an intruder.

[jordanpadams]

Thanks @jimmie !

TLDR; NASA does not strictly require password rotation, but because we, the PDS, are not imposing more strict authentication measures, like multi-factor authentication (MFA), this is our attempt to mitigate risk as best as we can for the time being.