{"id":35582,"date":"2019-10-31T22:05:11","date_gmt":"2019-10-31T19:05:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/periodicheskaya-smena-parolej-ustarevshaya-praktika-prishlo-vremya-ot-neyo-otkazatsya\/"},"modified":"2019-10-31T22:05:11","modified_gmt":"2019-10-31T19:05:11","slug":"periodicheskaya-smena-parolej-ustarevshaya-praktika-prishlo-vremya-ot-neyo-otkazatsya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/periodicheskaya-smena-parolej-ustarevshaya-praktika-prishlo-vremya-ot-neyo-otkazatsya","title":{"rendered":"Pravideln\u00e1 zm\u011bna hesel je zastaral\u00e1 praxe, je \u010das se j\u00ed zbavit.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V mnoha IT syst\u00e9mech plat\u00ed povinn\u00e9 pravidlo pravideln\u00e9 v\u00fdm\u011bny hesel. To je pravd\u011bpodobn\u011b nejobl\u00edben\u011bj\u0161\u00ed a neju\u017eite\u010dn\u011bj\u0161\u00ed po\u017eadavek na bezpe\u010dnostn\u00ed syst\u00e9my. N\u011bkte\u0159\u00ed u\u017eivatel\u00e9 jako tip m\u011bn\u00ed \u010d\u00edslo na konci.<\/p>\n

Takov\u00e1 praxe zp\u016fsobovala \u0159adu nep\u0159\u00edjemnost\u00ed. Lidem v\u0161ak nezb\u00fdvalo ne\u017e to sn\u00e1\u0161et, nebo\u0165 to bylo kv\u016fli bezpe\u010dnosti<\/i>. Nyn\u00ed je tento tip zcela neaktu\u00e1ln\u00ed. V kv\u011btnu 2019 dokonce spole\u010dnost Microsoft kone\u010dn\u011b zru\u0161ila po\u017eadavek na pravidelnou zm\u011bnu hesel ze z\u00e1kladn\u00edho souboru bezpe\u010dnostn\u00edch po\u017eadavk\u016f pro osobn\u00ed a serverov\u00e9 verze Windows 10: zde je ofici\u00e1ln\u00ed prohl\u00e1\u0161en\u00ed na blogu<\/a><\/noindex> se seznamem zm\u011bn k verzi Windows 10 v1903 (v\u0161imn\u011bte si fr\u00e1ze Zru\u0161en\u00ed politik expiring password policies, kter\u00e9 vy\u017eaduj\u00ed pravideln\u00e9 zm\u011bny hesel<\/i>). Samotn\u00e1 pravidla a syst\u00e9mov\u00e9 politiky Z\u00e1kladn\u00ed bezpe\u010dnostn\u00ed politika Windows 10 Verze 1903 a Windows Server 2019<\/i> jsou sou\u010d\u00e1st\u00ed bal\u00ed\u010dku Microsoft Security Compliance Toolkit 1.0<\/a><\/noindex>.<\/p>\n

M\u016f\u017eete tyto dokumenty uk\u00e1zat veden\u00ed a \u0159\u00edct: \u010dasy se zm\u011bnily. Povinn\u00e1 zm\u011bna hesel je archaismus, nyn\u00ed t\u00e9m\u011b\u0159 ofici\u00e1ln\u011b. Dokonce ani bezpe\u010dnostn\u00ed audit ji\u017e nebude kontrolovat tento po\u017eadavek (pokud se orientuje podle ofici\u00e1ln\u00edch pravidel pro z\u00e1kladn\u00ed ochranu po\u010d\u00edta\u010d\u016f s Windows).
\n<\/a><\/noindex>
\n\"Pravideln\u00e1
\nFragment seznamu se z\u00e1kladn\u00edmi bezpe\u010dnostn\u00edmi politikami Windows 10 v1809 a zm\u011bnami v 1903, kde se p\u0159\u00edslu\u0161n\u00e9 politiky o dob\u011b platnosti hesel ji\u017e neuplat\u0148uj\u00ed. Mimochodem, v nov\u00e9 verzi se tak\u00e9 standardn\u011b ru\u0161\u00ed administr\u00e1torsk\u00e9 a hostuj\u00edc\u00ed \u00fa\u010dty<\/i><\/p>\n

Microsoft jasn\u011b vysv\u011btluje na blogu, pro\u010d se vzdala pravidla o povinn\u00e9 zm\u011bn\u011b hesla: \u201ePravideln\u00e9 vypr\u0161en\u00ed platnosti hesla chr\u00e1n\u00ed pouze p\u0159ed pravd\u011bpodobnost\u00ed, \u017ee heslo (nebo hash) bude ukradeno b\u011bhem jeho platnosti a bude pou\u017eito neopr\u00e1vn\u011bnou osobou. Pokud heslo nebylo ukradeno, nem\u00e1 smysl je m\u011bnit. A pokud m\u00e1te d\u016fkazy, \u017ee bylo heslo ukradeno, rozhodn\u011b budete cht\u00edt jednat okam\u017eit\u011b, a ne\u010dekat na vypr\u0161en\u00ed platnosti, abyste probl\u00e9m vy\u0159e\u0161ili.\u201c<\/p>\n

D\u00e1le Microsoft vysv\u011btluje, \u017ee v dne\u0161n\u00ed dob\u011b je \u0161patn\u00e9 chr\u00e1nit se p\u0159ed kr\u00e1de\u017e\u00ed hesel t\u00edmto zp\u016fsobem: \u201ePokud je zn\u00e1mo, \u017ee heslo pravd\u011bpodobn\u011b bude ukradeno, jak dlouh\u00e1 doba je p\u0159ijateln\u00e1 pro umo\u017en\u011bn\u00ed zlod\u011bji pou\u017e\u00edt toto ukraden\u00e9 heslo? V\u00fdchoz\u00ed hodnota je 42 dn\u00ed. Nen\u00ed to sm\u011b\u0161n\u011b dlouh\u00e1 doba? Opravdu, je to velmi dlouho, a p\u0159esto na\u0161e sou\u010dasn\u00e1 z\u00e1kladn\u00ed \u00farove\u0148 byla nastavena na 60 dn\u00ed \u2014 d\u0159\u00edve na 90 dn\u00ed \u2014 proto\u017ee \u010dast\u00e1 expirace p\u0159in\u00e1\u0161\u00ed dal\u0161\u00ed probl\u00e9my. A pokud heslo nutn\u011b nebude ukradeno, z\u00edsk\u00e1te tyto probl\u00e9my bez u\u017eitku. Krom\u011b toho, pokud jsou va\u0161i u\u017eivatel\u00e9 ochotni vym\u011bnit heslo za sladkost, \u017e\u00e1dn\u00e1 politika expirace hesel nepom\u016f\u017ee.<\/p>\n

Alternativa<\/h1>\n

\nMicrosoft uv\u00e1d\u00ed, \u017ee jej\u00ed z\u00e1kladn\u00ed bezpe\u010dnostn\u00ed politiky jsou ur\u010deny pro dob\u0159e spravovan\u00e9 podniky, kter\u00e9 se staraj\u00ed o bezpe\u010dnost. Tak\u00e9 maj\u00ed slou\u017eit jako vod\u00edtko pro auditory. Pokud takov\u00e1 organizace zavedla seznamy zak\u00e1zan\u00fdch hesel, v\u00edcefaktorovou autentizaci, detekci pokus\u016f o heslov\u00e9 \u00fatoky a detekci anom\u00e1ln\u00edch pokus\u016f o p\u0159ihl\u00e1\u0161en\u00ed, je pot\u0159eba, aby heslo m\u011blo periodickou expiraci? A pokud nezavedli modern\u00ed ochrann\u00e9 prost\u0159edky, pom\u016f\u017ee jim expirace hesla?<\/p>\n

Logika Microsoftu je p\u0159ekvapiv\u011b p\u0159esv\u011bd\u010div\u00e1. M\u00e1me dv\u011b mo\u017enosti:<\/p>\n

    \n
  1. Spole\u010dnost zavedla modern\u00ed ochrann\u00e9 prost\u0159edky.\n<\/li>\n
  2. Spole\u010dnost ne<\/i> zavedla modern\u00ed ochrann\u00e9 prost\u0159edky.<\/li>\n<\/ol>\n

    \nV prvn\u00edm p\u0159\u00edpad\u011b pravideln\u00e1 zm\u011bna hesla nep\u0159in\u00e1\u0161\u00ed \u017e\u00e1dn\u00e9 dal\u0161\u00ed v\u00fdhody.<\/p>\n

    Ve druh\u00e9m p\u0159\u00edpad\u011b je pravideln\u00e1 zm\u011bna hesla bezcenn\u00e1.<\/p>\n

    Tak\u017ee m\u00edsto expirace hesla by m\u011blo b\u00fdt prim\u00e1rn\u011b pou\u017eito, v\u00edcefaktorovou autentizaci<\/b>. Dal\u0161\u00ed ochrann\u00e9 prost\u0159edky jsou uvedeny v\u00fd\u0161e: seznamy zak\u00e1zan\u00fdch hesel, detekce bruteforce a dal\u0161\u00edch anom\u00e1ln\u00edch pokus\u016f o p\u0159ihl\u00e1\u0161en\u00ed.<\/p>\n

    \u00abPravideln\u00e1 expirace hesla je archaick\u00e9 a zastaral\u00e9 ochrann\u00e9 opat\u0159en\u00ed.<\/i>, \u2014 shrnuje Microsoft, \u2014 a my se domn\u00edv\u00e1me, \u017ee pro na\u0161i \u00farove\u0148 z\u00e1kladn\u00ed ochrany nen\u00ed t\u0159eba uplat\u0148ovat \u017e\u00e1dnou konkr\u00e9tn\u00ed hodnotu. T\u00edm, \u017ee ji odstran\u00edme z na\u0161\u00ed z\u00e1kladn\u00ed \u00farovn\u011b, mohou organizace vyb\u00edrat to, co nejl\u00e9pe odpov\u00edd\u00e1 jejich o\u010dek\u00e1van\u00fdm pot\u0159eb\u00e1m, ani\u017e by to odporovalo na\u0161im doporu\u010den\u00edm.<\/p>\n

    V\u00fdstup<\/h1>\n

    \nCo si m\u016f\u017ee myslit extern\u00ed pozorovatel, pokud firma dnes nut\u00ed u\u017eivatele pravideln\u011b m\u011bnit hesla?<\/p>\n

      \n
    1. Dan\u00e9:<\/b> firma pou\u017e\u00edv\u00e1 zastaral\u00fd ochrann\u00fd mechanismus.\n<\/li>\n
    2. P\u0159edpoklad:<\/b> firma neimplementovala modern\u00ed ochrann\u00e9 mechanismy.\n<\/li>\n
    3. V\u00fdstup:<\/b> tato hesla jsou sn\u00e1ze dostupn\u00e1 a pou\u017eiteln\u00e1.<\/li>\n<\/ol>\n

      \nTo znamen\u00e1, \u017ee pravideln\u00e1 zm\u011bna hesel d\u011bl\u00e1 firmu atraktivn\u011bj\u0161\u00ed c\u00edlem pro \u00fatoky.<\/p>\n

      \n\"Pravideln\u00e1
      \n<\/a><\/noindex>
      \n
      Zdroj:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u0412\u043e \u043c\u043d\u043e\u0433\u0438\u0445 IT-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043f\u0435\u0440\u0438\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u043c\u0435\u043d\u044b \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u042d\u0442\u043e, \u043f\u043e\u0436\u0430\u043b\u0443\u0439, \u0441\u0430\u043c\u043e\u0435 \u043d\u0435\u043d\u0430\u0432\u0438\u0441\u0442\u043d\u043e\u0435 \u0438 \u0441\u0430\u043c\u043e\u0435 \u0431\u0435\u0441\u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043b\u0430\u0439\u0444\u0445\u0430\u043a\u0430 \u043f\u0440\u043e\u0441\u0442\u043e \u043c\u0435\u043d\u044f\u044e\u0442 \u0446\u0438\u0444\u0440\u0443 \u0432 \u043a\u043e\u043d\u0446\u0435. \u0422\u0430\u043a\u0430\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0430 \u0432\u044b\u0437\u044b\u0432\u0430\u043b\u0430 \u043c\u0430\u0441\u0441\u0443 \u043d\u0435\u0443\u0434\u043e\u0431\u0441\u0442\u0432. \u041e\u0434\u043d\u0430\u043a\u043e \u043b\u044e\u0434\u044f\u043c \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u043b\u043e\u0441\u044c \u0442\u0435\u0440\u043f\u0435\u0442\u044c, \u0432\u0435\u0434\u044c \u044d\u0442\u043e \u0440\u0430\u0434\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0422\u0435\u043f\u0435\u0440\u044c \u044d\u0442\u043e\u0442 \u0441\u043e\u0432\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u043d\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u0435\u043d. \u0412 \u043c\u0430\u0435 2019 \u0433\u043e\u0434\u0430 \u0434\u0430\u0436\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35582","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pravideln\u00e1 zm\u011bna hesel je zastaral\u00e1 praxe, je na \u010dase se j\u00ed vzd\u00e1t | ProHoster","description":"V mnoha IT syst\u00e9mech plat\u00ed povinn\u00e9 pravidlo pravideln\u00e9 zm\u011bny hesel. To je snad nejnen\u00e1vid\u011bn\u011bj\u0161\u00ed a nejv\u00edce zbyte\u010dn\u00fd po\u017eadavek bezpe\u010dnostn\u00edch syst\u00e9m\u016f.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/periodicheskaya-smena-parolej-ustarevshaya-praktika-prishlo-vremya-ot-neyo-otkazatsya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0438\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0441\u043c\u0435\u043d\u0430 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u2014 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0430\u044f \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0430, \u043f\u0440\u0438\u0448\u043b\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0442 \u043d\u0435\u0451 \u043e\u0442\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f | ProHoster","og:description":"\u0412\u043e \u043c\u043d\u043e\u0433\u0438\u0445 IT-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043f\u0435\u0440\u0438\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u043c\u0435\u043d\u044b \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u042d\u0442\u043e, \u043f\u043e\u0436\u0430\u043b\u0443\u0439, \u0441\u0430\u043c\u043e\u0435 \u043d\u0435\u043d\u0430\u0432\u0438\u0441\u0442\u043d\u043e\u0435 \u0438 \u0441\u0430\u043c\u043e\u0435 \u0431\u0435\u0441\u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/periodicheskaya-smena-parolej-ustarevshaya-praktika-prishlo-vremya-ot-neyo-otkazatsya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:11+00:00","article:modified_time":"2019-10-31T19:05:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35582","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 23:52:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:11:37","updated":"2026-01-21 23:52:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=35582"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35582\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=35582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=35582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=35582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}