Maximum Password Age

This determines how long users can keep a password before they have to change it. The aim is to force users to change their passwords periodically. Generally, you use a shorter period when security is very important and a longer period when security is less important. You can set the maximum password age to any value from 0 to 999, where a value of 0 specifies that passwords don't expire. Although you might be tempted to set no expiration date, users should change passwords regularly to ensure the network's security. Where security is a concern, good values are 30, 60, or 90 days. Where security is less important, good values are 120, 150, or 180 days.

Source: http://technet.microsoft.com/en-us/magazine/ff741764.aspx

Password Best practices

Define password policy so that all user accounts are protected with strong passwords.

1. Define the Enforce password history policy setting so that several previous passwords are remembered. With this policy setting, users cannot use the same password when their password expires.
2. Define the Maximum password age policy setting so that passwords expire as often as necessary for your environment, typically, every 30 to 90 days. With this policy setting, if an attacker cracks a password, the attacker only has access to the network until the password expires.
3. Define the Minimum password age policy setting so that passwords cannot be changed until they are more than a certain number of days old. This policy setting works in combination with the Enforce password history policy setting. If a minimum password age is defined, users cannot repeatedly change their passwords to get around the Enforce password history policy setting and then use their original password. Users must wait the specified number of days to change their passwords.
4. Define a Minimum password length policy setting so that passwords must consist of at least a specified number of characters. Long passwords -- seven or more characters -- are usually stronger than short ones. With this policy setting, users cannot use blank passwords, and they have to create passwords that are a certain number of characters long.
5. Enable the Password must meet complexity requirements policy setting. This policy setting checks all new passwords to ensure that they meet basic strong password requirements. For a full list of these requirements, see Passwords must meet complexity requirements.
6. For information about how to apply or modify these policy settings, see Apply or modify password policy. For information about each of these policy settings, see Password Policy.

Source: http://technet.microsoft.com/en-us/library/cc784090(WS.10).aspx

Facebook Security

You forgot your Facebook password again? Or maybe you got your Facebook account hacked because of your easy to guess password? The Facebook password is the one and only thing that is needed to access Facebook. Sure, there is the email or username, but that's easier to guess than the password, right? Someone who knows your Facebook username only needs the password, and boom, they are in and control your account.

Guess what those malicious users do most of the time? First, they change the password, so that you will have a harder time logging in. Then they can do all kinds of things, like posting on your wall, removing or adding friends, harassing users or reading private messages.

To avoid this, Facebook account owners need to take good care of their password. How can we describe it the best: Think of your password as your wallet. Losing your wallet can have all kinds of consequences, from losing the money in the wallet, to credit card bills and identity theft.

Source: http://bestoffacebook.com/category/facebook-security/

Protect Your Password From Misuse

• Do not let anyone else know or use your password.
• For optimum security, don't write your password down.
• Be aware of when a password is sent securely across the Internet. URLs (Web addresses) that begin with "https://"rather than "http://"are secure for use of your password. The "s" in "https" means that the Web site is encrypted and cannot easily be read by other people.
• If you suspect that someone else may know your current password, change your password immediately.
• Change your password periodically, even if it hasn't been compromised.
• Don't type your password while anyone is watching.

Source: http://www.thesecuritypub.com/security-awareness-topic-1-password-best-practices

Changing And Reusing Passwords

Over time, passwords may be compromised in many ways, including:

• Users may share them with friends or coworkers.
• Users may write them down and they may subsequently be exposed.
• Passwords may be guessed, either by humans or software.
• The servers that store passwords may be compromised and their passwords acquired by an intruder (encrypted, hashed or plaintext).
• The networks over which passwords travel, between a user's workstation and the system into which the user signs in may be compromised, again leading to compromise of a password.
• Users may be tricked into revealing their passwords (phishing).
• The help desk may be tricked into giving an intruder a valid password (social engineering).

To limit the usefulness of passwords that have been compromised, a best practice is to change them regularly. A common rule in many organizations is to force users to change their passwords when they log in, every 60 or 90 days.

In general, users should be required to change their passwords regularly. The password expiry interval should not be longer than 90 days.

Source: http://www.psynch.com/docs/password-management-best-practices.html