Where I work I'm forced to change my password every 90 days.  This security measure has been in place in many organizations for as long as I can remember.  Is there a specific security vulnerability or attack that this is designed to counter, or are we just following the procedure because "it's the way it has always been done"?

It seems like changing my password would only make me more secure if someone is already in my account.


  This question was IT Security Question of the Week.
  Read the Jul 15, 2011 blog entry for more details or submit your own Question of the Week.


The reason password expiration policies exist, is to mitigate the problems that would occur if an attacker acquired the password hashes of your system and were to break them. These policies  also help minimize some of the risk associated with losing older backups to an attacker.

For example, if an attacker were to break in and acquire your shadow password file, they could then start brute forcing the passwords without further accessing the system.  Once they know your password, they can access the system and install whatever back doors they want unless you happen to have changed your password in the time between the attacker acquiring the shadow password file and when they are able to brute force the password hash.  If the password hash algorithm is secure enough to hold off the attacker for 90 days, password expiration ensures that the attacker won't gain anything of further value from the shadow password file, with the exception of the already obtained list of user accounts.

While competent admins are going to secure the actual shadow password file, organizations as a whole tend to be more lax about backups, particularly older backups.  Ideally, of course, everyone would be just as careful with the tape that has the backup from 6 months ago as they are with the production data.  In reality, though, some older tapes inevitably get misplaced, misfiled, and otherwise lost in large organizations.  Password expiration policies limit the damage that is done if an older backup is lost for the same reason that it mitigates the compromise of the password hashes from the live system.  If you lose a 6 month old backup, you are encrypting the sensitive information and all the passwords have expired since the backup was taken, you probably haven't lost anything but the list of user accounts.
