Asking User to adopt to new password Policy

Question

Background: I am working on a enterprise application where... 1. There can be 100 users in it and 1 admin for a single enterprise account. 2. Account admin can customise various settings in this particular application. 3. Our products is used very less by our final users. In an average our user login for 6 minutes on every weekday.

The story I am working on: As a user, I should be notify when the password policy is changed by my account admin. The system should notify me( as a user) that I need to change my password because my current password is not compliant to the new Password policy.

Also to note that this is an edge case. Not ever time an admin will change password policy. (Password policy is like number of minimum characters, uppercase lower case, numbers, special characters- this feature is their to cater various password policy for different organizations.

This is the kind of experience I wanted to give, where we do not force the user to change the password immediately. We give them a window of 7days to update password at a sweet time. :

But my PO does not want that, he wants to force users to change password immediately.

I am absolutely not convinced to interrupt user to change password immediately. But the PO thinks that it is a security issue and above that it is a company decision. Opinion Please.

Answer 1

I think it's more graceful to notify users and then give them a time period within which they can update their password. Alternatively,

Instead of immediately logging out users out of their active sessions, you can force them to change their password on next login.

You can give an extra setting to the admin to choose whether s/he wants users to log out immediately on applying password policy. It could just be a checkbox like below:

[checkbox] Log out users immediately.

Answer 2

Passwords are the great conflict with authenticated users and security, there are many regurgitated 'best practices' that often lack though on the actual outcome to both user experience and the level of security gained. Forced password changes are one of these.

Your PO wnat's to optimmise secuirty above user experience and being a commerical entity this is probably the right approach, within reason. However the required specifications for a secure password compared to the ability for average users to create passwords that meet that specification and retain a level of usability is the issue that faces security. So in forcing user to change passwords you gamble with the risk the new password is not secure but meet those standards. This is a growing and rational opinon of security organsiations worldwide. https://www.cesg.gov.uk/articles/problems-forcing-regular-password-expiry

If you force users to create new paswords immediately you greatly tip the balance of poorly created passwords. For example if you change your policy from 8 chars to 12 (which is good, if you already include alphanumeric and specific special chars) which immeditately will make most user accounts in breech of this policy. So if userA changes their password from 'passw0rd!' to passw0rd!"£$ does this enforce a greater level of security? No it doesn't, humans use patterns, to identify and remember everything, the simpler the pattern the easier it is to remember. So giving user spot test to create strong passwords on the spot will weaken security not strengthen it.

The other factor to include in discussions is that security breaches using individual accounts is usually reserved to admin accounts as these will be targeted due to their elevated access permissions, most general user accounts are obtain through obtain DB tables or hash files which are decrypted in bulk, so how secure are admin accounts and how easy is to access the applicaiton, it appears to be on an internal network so is the likely hood of bulk account access less likely?

As it's an enterprise application I would suggest that authentication should be handled by AD or another SSO or PKI environment, this makes it the best user experience as the user is not directly involved in authentication and security is as high as it can be.