1

Let's assume the following in a hospital:

  • Each nurse has her own Active Directory user, with a password.
  • The password expires automatically 90 days after the password was set.
  • A nurse uses her own Active Directory user name and password to log in to applications in the hospital.
  • They never log in to Windows with their user name and password. Instead, each department has its own user name and password. The nurses who work for that department log in to Windows with the user name and password of the department. This is because one computer could be used by multiple nurses without having to log off an on every time.

The problem is that the nurse doesn't know when her password will expire. And when it has expired, the nurse can't reset her password because the old password has expired. We have to ask for the old password when resetting the password because that is the only way we can authorize the user.

What would be a good way to prevent the password of a nurse from expiring? In other words: how to assure that each nurse resets her password before it expires?

Improve this question
5
  • 4
    Just playing devils advocate - why do the passwords need to expire at all? Is it just 'because that's what usually happens with passwords'? - I say this just because we should always question this sort of thing. Expiring passwords is a pain for users as it means they need to keep a mental note (or worse, a written record) of their constantly changing passwords, so from a UX perspective it's bad. So therefore; is it really required?
    – JonW ♦
    Commented Oct 24, 2013 at 15:35
  • Just to reinforce @JonW: There's quite a lot of research showing that password expiration and constraints reduce the security of the system - the best passwords are the ones users can remember without the need of noting. Can't produce references right now, but you should be able to find them yourself.
    – Izhaki
    Commented Oct 24, 2013 at 16:39
  • 1
    @JonW It's a good question. I guess this policy exists in the hospital because otherwise the passwords would never be changed by the nurses. Also: to remind them of the importance of keeping their password secret. They share their passwords with colleagues or write them on post-it notes (maybe they wouldn't do that anymore if they aren't forced to change their passwords that often).
    – Korneel
    Commented Oct 25, 2013 at 8:21
  • By the way, I don't think I could convince the IT manager to disable the password expiration policy. So from an end user's perspective: how to prevent her password from expiring, given this scenario?
    – Korneel
    Commented Oct 25, 2013 at 11:01
  • 1
    I dont want to start an answer with this because it is not really answer material but what about analyzing the typical nurse workflow. What are things the nurses do regularly for example on a mandatory basis. If you come up with for example: regular training sessions once a month -> first 10 minutes of training are everyone chaning their password. nurses log in an out in some time management software? -> every x days in the 90 days circle prompt a password change that needs to be completed before signing out / in.
    – Cadoc
    Commented Oct 27, 2013 at 11:07

1 Answer 1

Reset to default
2

Give users a method of being notified about password expiration outside of the system. For example, the notification settings can allow users to add their personal email or phone number.

Generally, I agree with JonW and Cadoc that this password process is problematic. It seems that each nurse already has too many accounts and passwords to use, but it may depend on whether nurses work in more than one department.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.