I Read the Entire Cybersecurity Executive Order; Here's What You Need to Know
The nightmares that normally come with govt stuff in this space I&#x27;m seeing.<p>1) Long passwords - govt loves these - think 12 characters or longer. Think &quot;EhKx~9RDmPMCW7&quot;<p>2) Failures to specify allowable characters or blocked characters - very annoying.<p>3) Hard lockouts (rather than more nuanced rate limiting etc) requiring password resets.<p>4) Password reset options are weak and not protected.<p>The backdoor is usually the password reset option.<p>Ie, agency will do crazy long password + SMS code to login, but you can then reset your password with just SMS. So the long passwords are often just for show.<p>They often also don&#x27;t time delay anything. So they&#x27;ll do things like immediate reset. For high value apps you should have a 4 - 24 hour delay on reset to allow legit user to react.<p>They&#x27;ll also often not have good ways to report bad password reset attempts other than via phone which goes no where.<p>They also often actively block password managers and cutting and pasting passwords. So annoying.<p>The IRS is currently requiring 90 day password rotations as well which are a nightmare. Coupled with hard account lockouts you have another nightmare.<p>The list goes on. For the millions to billions they spend you really wonder who is giving them advice.