<img src="https://ws.zoominfo.com/pixel/6169bf9791429100154fc0a2" width="1" height="1" style="display: none;">

Password Policy Best Practices

StrongDM manages and audits access to infrastructure.
  • Role-based, attribute-based, & just-in-time access to infrastructure
  • Connect any person or service to any infrastructure, anywhere
  • Logging like you've never seen

Passwords are one of the most common targets for hackers, so it’s imperative that your company enforce a strong password policy.  This policy will not only define the requirements of the password itself but the procedure your organization will use to select and securely manage passwords.

5 Password Policy Best Practices You Can Implement

Use a password manager

One of the biggest complaints your users may voice about your password requirements is “I’ll never remember a password like that!”  The good news is that by using a password manager, they won’t have to. A password manager - also sometimes called a password vault - is a convenient way to store passwords securely without having to commit them to memory.  The basic idea is you only have to remember a single password - which in turn opens up access to the rest of your passwords. Popular tools in this space include 1Password, LastPass, and Dashlane.  

Many of these tools will plug right into your users’ Web browsers, so next time a user signs up for an online service, the password manager will offer up an extremely secure password such as B6KcwU}9wP7JKfunE8vpG2fYyaB, which will be saved automatically for future use.  This way, the user isn’t tempted to use one of the world’s worst passwords, such as passw0rd.

Password creation

Clearly define password complexity requirements - including uppercase letters, lowercase letters, and minimum password length. This is an area where organizations tend to get a bit carried away.  It’s natural to think that a longer password is better, so some system administrators increase password minimum length to 15 or 20 characters. According to the password guidance published by Microsoft, longer passwords are not always better.  Among the recommendations in the paper, Microsoft advises:

  • Passwords should contain a minimum of 8 characters
  • Use a unique password for each site
  • Use multifactor authentication (MFA) wherever possible

Conveniently, using a password manager allows users to easily create passwords that meet your organization’s requirements.  Most of these solutions also support MFA, so you can add another layer of security to your password protection as well.

Password protection

In addition to enforcing what password management tools your users should use, such as a password manager, your policy needs to outline the ways users should not store passwords as well.  In other words, getting users to configure a password manager is great, but if they store their master password on a sticky note tucked under a keyboard, that’s not great!

Consider the following guidance statements to include in your password policy:

  • Store passwords in the provided password management tool
  • Use a unique password for each online account/service
  • Passwords should be treated as confidential and not shared with anyone
  • Do not write passwords down on paper
  • If you suspect unauthorized access to your account or think your password may be compromised, change your password immediately

Additionally, make sure employees are only using password managers approved by the company.  To make the adoption of a password manager easier, most of these products will also integrate right into your Active Directory.  That way, you can easily share passwords and enable access control between various users and groups without having to configure a separate permissions structure.

Password rotation

Outside of being forced to pick new passwords, users generally loathe periodic password changes as well.  Many information security experts feel that regular password rotation actually encourages users to be less secure with their practices.  For example, if a user account password is Winter2018, the next time they’re forced to do a password change, they might pick Spring2018.  Or if users are currently forced to use 10-character passwords and the organization ups the minimum to 12, users with Password12 as their password will just use Password1234.  In other words, users tend to use the minimum amount of effort to meet the password requirements. Thus they are likely to pick weak passwords.  According to the Microsoft password guidance document referenced earlier, if strong and unique passwords are used, you should be able to eliminate the need for periodic user account password rotations.  Still, as a general practice, companies are rotating passwords every quarter or at least twice a year.

Other tools to consider:

As you choose your password requirements and consider using tools like a password manager, you might also want to look into additional ways to streamline password use throughout your organization.  SSO (Single Sign-On) is a service that allows users to submit a username and password to a single portal and then be passed seamlessly to other services without having to re-authenticate. For example, you could set up SSO so that after logging into your directory system in the morning, users can check email, join Slack and manage timesheets without ever having to provide their credentials manually to any of those systems.  

As talked about earlier in this post, multi-factor authentication is a good complement to a strong password.  MFA is generally considered to be something you know (like your password) plus one of the following as an extra layer of protection:

Something you have

  • Text message
  • An app (such as Google Authenticator or Microsoft Authenticator)

Something you are

  • Retina scan
  • Fingerprint

Until someone creates a better solution, we will continue to use passwords to protect our most sensitive accounts and data.  A password policy, coupled with MFA, will help strengthen password requirements and make it much harder for attackers to breach our systems.  And because so much of our work life is online, not having a password policy in today’s age is simply negligent.


About the Author

, Security Engineer / Podcaster, is the president of 7 Minute Security, an information security consultancy in the Minneapolis area. Brian spends most of his days helping companies defend their networks.

Since 2004, Brian has also run the blog/podcast called 7 Minute Security, where he shares what he has learned about information security into short, 7-minute chunks.

StrongDM logo
💙 this post?
Then get all that StrongDM goodness, right in your inbox.

You May Also Like

SD-WAN vs. VPN: All You Need to Know
SD-WAN vs. VPN: All You Need to Know
Networking decisions can be challenging, and no one wants to make a costly mistake. The information in this article will help you understand how SD-WAN and VPN compare, so you can decide which option fits your organization best. You can find a networking solution that provides your employees with a secure internet connection while meeting your business needs and budget.
What is Cloud Scalability? Examples, Benefits, and More
What is Cloud Scalability? Examples, Benefits, and More
Cloud computing isn’t a trend, it’s how businesses grow. In 2022, most enterprises said they use cloud services, and more than half say they plan to spend even more on cloud applications and infrastructure in 2023. Cloud scalability offers flexibility at a reasonable price, making it an important business tool. In this article we’ll discuss what scalability is in cloud computing, the benefits of cloud computing scalability, and discuss ways businesses use scalability.
What is API Security? 11 Best Practices to Know
What is API Security? 11 Best Practices to Know
At any given moment, your network may be under attack. Are you prepared? Broken API authentication can expose your data and let hackers in. A data breach compromises an organization as well as its customers, destroying trust and losing customers. Don’t worry, though. The API security best practices in this article help you protect your network from malicious attacks.
CI/CD Security and CI/CD Pipeline Explained
CI/CD Security Explained: Securing CI/CD Pipeline with Access Automation
A continuous integration, continuous delivery pipeline—or CI/CD pipeline—is a process workflow companies use to streamline and automate software development. A CI/CD pipeline automatically builds and tests code changes to detect bugs before the new code is merged and deployed.
Cloud Native Security: Definition, Challenges, and Solutions
Cloud Native Security: Definition, Challenges, and Solutions
Cloud native security solutions can help organizations like yours protect your cloud resources, no matter when you transitioned to the cloud. Here’s everything you need to know about integrating cloud native security.