If your company does forced password updates, they are not following the NIST recommendation: https://pages.nist.gov/800-63-FAQ/#q-b05
If your company is not following the NIST recommendation, they are incompetent, and will be held liable in case of a breach.
They require us to change our passwords every 45 days now. When I pointed out the NIST recommendations of not rotating passwords, they say they are following the guidance of the response team that helped them recover from the ransomware. And that the NIST doesn't actually deal with the real world.
This is a stretch. Liable? Please show the case law, or the legislation.
(My statement has no relevance to the validity of NIST's recommendations)
Password1
Password2
Password3
Etc
PasswordFebruary2024!
Where month and year update on the date of forced password change.
hunter3
hunter4
hunter5
Password1
Password1
Password1
Etc?
So a hacker can infer that my password is tacokissies69000 of some sort..
