Credential change management system
A credential change management platform may, from a time period T1 to T2: deny access by remote client devices that submit credentials other than the prior or new credentials and, as a result of the denial, increment a lock-out counter, and allow access by devices that submit either the prior or new credential. From T2 to T3, the platform may: deny access by devices that submit credentials other than the prior or new credential and, as a result of the denial, increment the lock-out counter, deny access by devices that submit the prior credential without incrementing the lock-out counter, and allow access by devices that submit the new credential. After T3, the platform may: deny access by devices that submit credentials other than the new credential and, as a result of the denial, increment the lock-out counter, and allow access by devices that submit the new credential.
1. A credential change management system, comprising:
a credential data store containing electronic records associated with security credentials, the electronic records including at least a prior credential expiring at time T1 and a new credential effective beginning at time T1;
a communication port to exchange information with a plurality of remote client devices; and
a credential change management platform, coupled to the credential data store and the communication port, having at least one computer processor operatively coupled to at least one memory, wherein the processor is configured to:
during a first transitional time period from time T1 to time T2:
deny access by remote client devices that submit credentials other than the prior credential or the new credential and, as a result of the denial, increment a lock-out counter, and
allow access by remote client devices that submit either the prior credential or the new credential,
during a second transitional time period from time T2 to time T3:
deny access by remote client devices that submit credentials other than the prior credential or the new credential and, as a result of the denial, increment the lock-out counter,
deny access by remote client devices that submit the prior credential without incrementing the lock-out counter, and
allow access by remote client devices that submit the new credential, and
during a third time period after time T3:
deny access by remote client devices that submit credentials other than the new credential and, as a result of the denial, increment the lock-out counter, and
allow access by remote client devices that submit the new credential,
wherein the at least one processor of the credential change management platform dynamically adjusts the value of time T3 based on a determination that all remote client devices have successfully logged on with the new credential.
2. The credential change management system of claim 1 , wherein a remedial security action is taken when the lock-up counter exceeds a pre-determined threshold.
3. The credential change management system of claim 2 , wherein the lock-up counter is reset when access by a remote client device is allowed.
4. The credential change management system of claim 1 , wherein security credentials are associated with at least one of a username and a password.
5. The credential change management system of claim 1 , wherein a reminder message is transmitted to a remote client device that submits the prior credential during the second transitional time period.
6. The credential change management system of claim 5 , wherein the reminder message is reported to a central management tracking system.
7. The credential change management system of claim 1 , wherein the at least one processor of the credential change management platform is further configured to:
determine that an unauthorized user may have access to the prior credential; and
responsive to the determination, set time T1 to the same value as time T2 such that the duration of the first transition period is zero.
8. The credential change management system of claim 1 , wherein T3 is further dynamically adjusted based on a period of time during which no invalid logins with the old credential are detected.
9. The credential change management system of claim 1 , wherein the determination is based on Internet Protocol addresses.
10. The credential change management system of claim 1 , wherein the dynamic adjustment is performed by a management console.
11. The credential change management system of claim 10 , wherein the management console is adapted to automatically transmit an alert message to an administrator upon occurrence of a pre-determined condition.
12. The credential change management system of claim 10 , wherein the management console is adapted to generate an audit log.
13. A non-transitory, computer-readable medium storing program code, the program code executable by a processor of a credential change management platform to cause the platform to perform a method for credential change management in a system having a prior credential expiring at time T1 and a new credential effective beginning at time T1 the method comprising:
during a first transitional time period from time T1 to time T2:
denying access by remote client devices that submit credentials other than the prior credential or the new credential and, as a result of the denial, increment a lock-out counter, and
allowing access by remote client devices that submit either the prior credential or the new credential;
during a second transitional time period from time T2 to time T3:
denying access by remote client devices that submit credentials other than the prior credential or the new credential and, as a result of the denial, increment the lock-out counter,
denying access by remote client devices that submit the prior credential without incrementing the lock-out counter, and
allowing access by remote client devices that submit the new credential; and
during a third time period after time T3:
denying access by remote client devices that submit credentials other than the new credential and, as a result of the denial, increment the lock-out counter, and
allowing access by remote client devices that submit the new credential,
wherein the value of time T3 is dynamically adjusted based on a determination that all remote client devices have successfully logged on with the new credential.
14. The medium of claim 13 , wherein a reminder message is transmitted to a remote client device that submits the prior credential during the second transitional time period.
15. The medium of claim 13 , wherein the method further comprises:
determining that an unauthorized user may have access to the prior credential; and
responsive to the determination, setting time T1 to the same value as time T2 such that the duration of the first transition period is zero.
16. The medium of claim 13 , wherein the dynamic adjustment is further based on a period of time during which no invalid logins with the old credential are detected.
17. A method for credential change management in a system having a prior credential expiring at time T1 and a new credential effective beginning at time T1, comprising:
during a first transitional time period from time T1 to time T2:
denying access by remote client devices that submit credentials other than the prior credential or the new credential and, as a result of the denial, increment a lock-out counter, and
allowing access by remote client devices that submit either the prior credential or the new credential;
during a second transitional time period from time T2 to time T3:
denying access by remote client devices that submit credentials other than the prior credential or the new credential and, as a result of the denial, increment the lock-out counter,
denying access by remote client devices that submit the prior credential without incrementing the lock-out counter, and
allowing access by remote client devices that submit the new credential; and
during a third time period after time T3:
denying access by remote client devices that submit credentials other than the new credential and, as a result of the denial, increment the lock-out counter, and
allowing access by remote client devices that submit the new credential,
wherein the value of time T3 is dynamically adjusted based on a determination that all remote client devices have successfully logged on with the new credential.
18. The method of claim 17 , wherein a remedial security action is taken when the lock-up counter exceeds a pre-determined threshold.
19. The method of claim 17 , wherein the lock-up counter is reset when access by a remote client device is allowed.
20. The method of claim 17 , wherein security credentials are associated with at least one of a username and a password.