Prática GIAC GSEC

A company enforces that passwords must be at least 14 characters, and disables mandatory periodic password rotation in favor of length and breach-monitoring instead. Which current password guidance does this align with?

• ANIST SP 800-63B, which recommends longer passphrases over frequent forced rotation and checking passwords against breach corpuses
• BA policy requiring password changes every 30 days regardless of length
• CA policy banning passwords over 8 characters
• DA policy that stores passwords in plaintext for easier auditing