Forest Global Training Partners

Cyber Risks · Krebs on Security

A Breach, or Just a Forced Password Reset?

Summary: Citrix forced password resets for many ShareFile users in response to password-guessing attacks targeting people who reuse passwords across sites, and said it would do so regularly; many users read the reset as a breach, which Citrix denied. A Citrix spokesperson said the company did not enforce resets on accounts using its most robust multi-factor authentication, single sign-on, and did not answer questions about adopting regular resets despite NIST guidance against arbitrary periodic password changes.

What you should know: NIST warns that forcing periodic password changes leads users to pick weaker secrets and apply predictable transformations, so a policy meant to reduce risk can leave reused and guessable credentials in place - and Citrix tied the resets to attacks that historically arrive in waves.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related