How often must passwords and PINs be changed at a minimum?

Study for the Communication Security (COMSEC) Test. Use flashcards and multiple-choice questions with hints and explanations. Prepare effectively for your exam!

Multiple Choice

How often must passwords and PINs be changed at a minimum?

The recommended practice for changing passwords and PINs is to do so at least every 90 days. This timeframe is established to enhance security by limiting the time window during which a compromised credential can be exploited. Frequent updates help mitigate risks associated with unauthorized access, especially if there’s a possibility that credentials may have been exposed or guessed. Changing passwords and PINs too frequently, such as monthly or more often, can lead to user fatigue and may result in individuals adopting weaker passwords or resorting to insecure practices, like writing down their passwords, which can actually decrease security. In contrast, changing them less frequently, such as every 6 months or annually, does not provide sufficient protection against potential threats that could arise in a shorter time frame. Therefore, the 90-day interval strikes a balance between maintaining security and ensuring usability.

The recommended practice for changing passwords and PINs is to do so at least every 90 days. This timeframe is established to enhance security by limiting the time window during which a compromised credential can be exploited. Frequent updates help mitigate risks associated with unauthorized access, especially if there’s a possibility that credentials may have been exposed or guessed.

Changing passwords and PINs too frequently, such as monthly or more often, can lead to user fatigue and may result in individuals adopting weaker passwords or resorting to insecure practices, like writing down their passwords, which can actually decrease security. In contrast, changing them less frequently, such as every 6 months or annually, does not provide sufficient protection against potential threats that could arise in a shorter time frame. Therefore, the 90-day interval strikes a balance between maintaining security and ensuring usability.

More practice questions