Password expiration for Notes IDs

Password expiration is one of the most effective security policies around, for any kind of computer system. Yet I rarely find it in use at companies that hire me to consult. Why is it often neglected? Simple: users don't like it and it creates extra headaches for the IT staff. But the value of password expiration is obvious. When you create a Notes user account, do you want that account to be valid forever? Of course not. You want the account (ID) to automatically expire if no action is taken to maintain it, after some period of time. That's where password expiration comes in.

Before I dive into this topic, there are two objections readers might make right away:

Password expiration does involve more work for users and for administrators (when users forget their

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Spam and Security Securely connect Lotus Domino servers on different domains Protect Lotus Notes from malicious code with the Domino ECL How to correct Lotus Notes public key mismatches in four easy steps A recipe for secure IM success Telecommuter security kit Spear phishing: Don't be a target FAQ: Lotus Notes Domino password issues Security awareness training: How to educate employees about spyware Seven tips to strengthen your Domino e-mail security Admin2005 preview: Tips, techniques, and a look at Notes/Domino Rel. 7 Lotus Notes Domino Password Management An introduction to ID Vault in Lotus Notes/Domino 8.5 How to manage passwords to secure Lotus Notes/Domino environments An introduction to Lotus Notes password options and essentials Secure Lotus Notes 8 with the Internet password lockout feature Lotus Notes Domino password management tips Cracked users' HTTP passwords still a threat on many Lotus Notes R6 and R7 domains Multiple new Sober variants spy on passwords Resetting a Lotus Notes password FAQ: Lotus Notes Domino password issues Hashing out stronger password authentication

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

new passwords). So, this is an important question for your organization: "How serious do you want to be about computer security? You might legitimately answer, "Not too serious. Fixed passwords are good enough for us." But, depending on the nature of your company, you might answer, "We take data security quite seriously and are willing to take the steps necessary to improve it." In the latter case, you should strongly consider enabling password expiration for Notes IDs.

Here are the steps:

That's it! You have added a significant layer of security to your Domino/Notes system.

About the author: Chuck Connell is president of CHC-3 Consulting, which helps organizations with all aspects of Domino and Notes.

Do you have comments on this tip? Let us know.

Rate this Tip To rate tips, you must be a member of SearchDomino.com. Register now to start rating these tips. Log in if you are already a member. DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.