Software security lessons from someone who has spent a number of years cleaning a toilet used primarily by a small child:
1) end users cannot be trusted to provide input in the way you expect, they will continue to surprise you
2) end user input will make it way to places you thought impossible
3) end user input utimately will need to be sanitised multiple times
Genie: I’ll give you one billion dollars if you can spend 100M in a month. There are 3 rules: No gifting, no gambling, no throwing it away.
SRE: Can I use AWS?
Genie: There are 4 rules.
I really hate password/PIN code expiration. It WORSENS security, because you're forced to remember a new password/PIN and after forgetting it a few times will probably write it down. Or you might be tempted to use an easier to remember and less secure password.
NIST no longer recommends expiring credentials regularly. PLEASE STOP DOING THIS.