Password Policy Best Practices

Passwords are one of the most common targets for hackers, so it’s imperative that your company enforce a strong password policy.  This policy will not only define the requirements of the password itself but the procedure your organization will use to select and securely manage passwords.

5 Password Policy Best Practices You Can Implement

Use a password manager

‍One of the biggest complaints your users may voice about your password requirements is “I’ll never remember a password like that!”  The good news is that by using a password manager, they won’t have to. A password manager - also sometimes called a password vault - is a convenient way to store passwords securely without having to commit them to memory.  The basic idea is you only have to remember a single password - which in turn opens up access to the rest of your passwords. Popular tools in this space include 1Password, LastPass, and Dashlane.  

Many of these tools will plug right into your users’ Web browsers, so next time a user signs up for an online service, the password manager will offer up an extremely secure password such as B6KcwU}9wP7JKfunE8vpG2fYyaB, which will be saved automatically for future use.  This way, the user isn’t tempted to use one of the world’s worst passwords, such as passw0rd.

Password creation

Clearly define password complexity requirements - including uppercase letters, lowercase letters, and minimum password length. This is an area where organizations tend to get a bit carried away.  It’s natural to think that a longer password is better, so some system administrators increase password minimum length to 15 or 20 characters. According to the password guidance published by Microsoft, longer passwords are not always better.  Among the recommendations in the paper, Microsoft advises:

• Passwords should contain a minimum of 8 characters
• Use a unique password for each site
• Use multifactor authentication (MFA) wherever possible

Conveniently, using a password manager allows users to easily create passwords that meet your organization’s requirements.  Most of these solutions also support MFA, so you can add another layer of security to your password protection as well.

Password protection

In addition to enforcing what password management tools your users should use, such as a password manager, your policy needs to outline the ways users should not store passwords as well.  In other words, getting users to configure a password manager is great, but if they store their master password on a sticky note tucked under a keyboard, that’s not great!

Consider the following guidance statements to include in your password policy:

• Store passwords in the provided password management tool
• Use a unique password for each online account/service
• Passwords should be treated as confidential and not shared with anyone
• Do not write passwords down on paper
• If you suspect unauthorized access to your account or think your password may be compromised, change your password immediately

Additionally, make sure employees are only using password managers approved by the company.  To make the adoption of a password manager easier, most of these products will also integrate right into your Active Directory.  That way, you can easily share passwords and enable access control between various users and groups without having to configure a separate permissions structure.

Password rotation

Outside of being forced to pick new passwords, users generally loathe periodic password changes as well.  Many information security experts feel that regular password rotation actually encourages users to be less secure with their practices.  For example, if a user account password is Winter2018, the next time they’re forced to do a password change, they might pick Spring2018.  Or if users are currently forced to use 10-character passwords and the organization ups the minimum to 12, users with Password12 as their password will just use Password1234.  In other words, users tend to use the minimum amount of effort to meet the password requirements. Thus they are likely to pick weak passwords.  According to the Microsoft password guidance document referenced earlier, if strong and unique passwords are used, you should be able to eliminate the need for periodic user account password rotations.  Still, as a general practice, companies are rotating passwords every quarter or at least twice a year.

Other tools to consider:

As you choose your password requirements and consider using tools like a password manager, you might also want to look into additional ways to streamline password use throughout your organization.  SSO (Single Sign-On) is a service that allows users to submit a username and password to a single portal and then be passed seamlessly to other services without having to re-authenticate. For example, you could set up SSO so that after logging into your directory system in the morning, users can check email, join Slack and manage timesheets without ever having to provide their credentials manually to any of those systems.  

As talked about earlier in this post, multi-factor authentication is a good complement to a strong password.  MFA is generally considered to be something you know (like your password) plus one of the following as an extra layer of protection:

Something you have

• Text message
• An app (such as Google Authenticator or Microsoft Authenticator)

Something you are

• Retina scan
• Fingerprint

Until someone creates a better solution, we will continue to use passwords to protect our most sensitive accounts and data.  A password policy, coupled with MFA, will help strengthen password requirements and make it much harder for attackers to breach our systems.  And because so much of our work life is online, not having a password policy in today’s age is simply negligent.