<img src="https://ws.zoominfo.com/pixel/6169bf9791429100154fc0a2" width="1" height="1" style="display: none;">
LAUNCH WEEK 🚀 Enable continuous, contextual + granular authorization. Learn more.

Password Policy Best Practices

StrongDM manages and audits access to infrastructure.
  • Role-based, attribute-based, & just-in-time access to infrastructure
  • Connect any person or service to any infrastructure, anywhere
  • Logging like you've never seen

Passwords are one of the most common targets for hackers, so it’s imperative that your company enforce a strong password policy.  This policy will not only define the requirements of the password itself but the procedure your organization will use to select and securely manage passwords.

5 Password Policy Best Practices You Can Implement

Use a password manager

One of the biggest complaints your users may voice about your password requirements is “I’ll never remember a password like that!”  The good news is that by using a password manager, they won’t have to. A password manager - also sometimes called a password vault - is a convenient way to store passwords securely without having to commit them to memory.  The basic idea is you only have to remember a single password - which in turn opens up access to the rest of your passwords. Popular tools in this space include 1Password, LastPass, and Dashlane.  

Many of these tools will plug right into your users’ Web browsers, so next time a user signs up for an online service, the password manager will offer up an extremely secure password such as B6KcwU}9wP7JKfunE8vpG2fYyaB, which will be saved automatically for future use.  This way, the user isn’t tempted to use one of the world’s worst passwords, such as passw0rd.

Password creation

Clearly define password complexity requirements - including uppercase letters, lowercase letters, and minimum password length. This is an area where organizations tend to get a bit carried away.  It’s natural to think that a longer password is better, so some system administrators increase password minimum length to 15 or 20 characters. According to the password guidance published by Microsoft, longer passwords are not always better.  Among the recommendations in the paper, Microsoft advises:

  • Passwords should contain a minimum of 8 characters
  • Use a unique password for each site
  • Use multifactor authentication (MFA) wherever possible

Conveniently, using a password manager allows users to easily create passwords that meet your organization’s requirements.  Most of these solutions also support MFA, so you can add another layer of security to your password protection as well.

Password protection

In addition to enforcing what password management tools your users should use, such as a password manager, your policy needs to outline the ways users should not store passwords as well.  In other words, getting users to configure a password manager is great, but if they store their master password on a sticky note tucked under a keyboard, that’s not great!

Consider the following guidance statements to include in your password policy:

  • Store passwords in the provided password management tool
  • Use a unique password for each online account/service
  • Passwords should be treated as confidential and not shared with anyone
  • Do not write passwords down on paper
  • If you suspect unauthorized access to your account or think your password may be compromised, change your password immediately

Additionally, make sure employees are only using password managers approved by the company.  To make the adoption of a password manager easier, most of these products will also integrate right into your Active Directory.  That way, you can easily share passwords and enable access control between various users and groups without having to configure a separate permissions structure.

Password rotation

Outside of being forced to pick new passwords, users generally loathe periodic password changes as well.  Many information security experts feel that regular password rotation actually encourages users to be less secure with their practices.  For example, if a user account password is Winter2018, the next time they’re forced to do a password change, they might pick Spring2018.  Or if users are currently forced to use 10-character passwords and the organization ups the minimum to 12, users with Password12 as their password will just use Password1234.  In other words, users tend to use the minimum amount of effort to meet the password requirements. Thus they are likely to pick weak passwords.  According to the Microsoft password guidance document referenced earlier, if strong and unique passwords are used, you should be able to eliminate the need for periodic user account password rotations.  Still, as a general practice, companies are rotating passwords every quarter or at least twice a year.

Other tools to consider:

As you choose your password requirements and consider using tools like a password manager, you might also want to look into additional ways to streamline password use throughout your organization.  SSO (Single Sign-On) is a service that allows users to submit a username and password to a single portal and then be passed seamlessly to other services without having to re-authenticate. For example, you could set up SSO so that after logging into your directory system in the morning, users can check email, join Slack and manage timesheets without ever having to provide their credentials manually to any of those systems.  

As talked about earlier in this post, multi-factor authentication is a good complement to a strong password.  MFA is generally considered to be something you know (like your password) plus one of the following as an extra layer of protection:

Something you have

  • Text message
  • An app (such as Google Authenticator or Microsoft Authenticator)

Something you are

  • Retina scan
  • Fingerprint

Until someone creates a better solution, we will continue to use passwords to protect our most sensitive accounts and data.  A password policy, coupled with MFA, will help strengthen password requirements and make it much harder for attackers to breach our systems.  And because so much of our work life is online, not having a password policy in today’s age is simply negligent.


About the Author

, Security Engineer / Podcaster, is the president of 7 Minute Security, an information security consultancy in the Minneapolis area. Brian spends most of his days helping companies defend their networks.

Since 2004, Brian has also run the blog/podcast called 7 Minute Security, where he shares what he has learned about information security into short, 7-minute chunks.

StrongDM logo
💙 this post?
Then get all that StrongDM goodness, right in your inbox.

You May Also Like

Joiners, Movers, and Leavers (JML) Process (How to Secure It)
Joiners, Movers, and Leavers (JML) Process (How to Secure It)
People come, and people go, and while digital identities should cease to exist after a departure, many times, this doesn’t happen. At any given time, organizations can have thousands of user identities to manage and track, so when processes aren’t automated, it’s easy for many identities to fall through the cracks. This phenomenon is called Identity Lifecycle Management, and when it comes to access and security, it’s worth the time to get it right.
AWS Well-Architected Framework Security Best Practices
AWS Well-Architected Framework Security Best Practices
The AWS Well-Architected Framework has been a staple for many years for AWS practitioners of all sorts, including cloud architects and platform engineers. It’s a blueprint for architectural and design best practices that will lay the foundation for resilience, operational efficiency, and security on the AWS Cloud.
Fine-Grained vs. Coarse-Grained Access Control Explained
Fine-Grained vs. Coarse-Grained Access Control Explained
If credentials fall into the wrong hands, intruders may enter a network and launch a disastrous attack. In fact, 46% of cybersecurity incidents involve authentication credentials, according to the Verizon 2022 Data Breach Investigations Report. Organizations have two general ways to determine someone’s access rights once past initial authentication: Coarse-grained access control (CGAC), which relies on a single factor, and fine-grained access control (FGAC), which relies on multiple factors. Traditionally, CGAC has been the easier option, while FGAC offers superior security at the cost of more complex implementation.
MITRE ATT&CK Framework Containers Matrix for Kubernetes
MITRE ATT&CK Framework Containers Matrix for Kubernetes
If you’re Kuberntes admin and you’re not familiar with the tactics outlined in the MITRE ATT&CK framework, this blog post is for you. MITRE ATT&CK framework is an extensive knowledge base of tactics and techniques employed by bad actors that defensive security experts use to help defend their organizations against attack, and many times, used by their offensive security counterparts to test their weaknesses.
Unlocking Zero Trust: The Kipling Method for Policy Writing
Unlocking Zero Trust: The Kipling Method for Policy Writing
To embark on a successful Zero Trust journey, it's crucial to articulate and implement policies that align seamlessly with your business model. The Kipling Method serves as a guiding light in this endeavor. Let's delve into the six fundamental questions it poses.