Randall Munroe  It may be Halloween, but for thousands of
corporate IT users there's another reason today inspires fear:
it's time once again for the mandatory end-of-month password
change. Few common IT policies drive users to distraction as
regularly and reliably as the aggressiveness of enterprise
password policies.  But with more potential threats to
enterprise security coming from external sources that take
advantage of the users' accounts once they're already logged in,
do byzantine password policies really do anything to protect
corporate data? In some cases, the password policy may create a
bigger security threat than the risk of a password being
guessed.  The password problem Passwords are still important,
but the value of aggressive password policies as security
against unauthorised access is questionable, said Andrew
Marshall, CIO of Philadelphia-based Campus Apartments in an
interview with Ars Technica. "Statistical attacks -- repeated
attempts at guessing a password using hints or a dictionary --