The problems with forcing regular password expiry
cesg.gov.uk