<img src="https://ws.zoominfo.com/pixel/6169bf9791429100154fc0a2" width="1" height="1" style="display: none;">

PAM Was Dead. StrongDM Just Brought it Back to Life. ✨  An important message from StrongDM's CEO!

Close icon
Search bar icon

5 Password Policy Best Practices You Can Implement

StrongDM manages and audits access to infrastructure.
  • Role-based, attribute-based, & just-in-time access to infrastructure
  • Connect any person or service to any infrastructure, anywhere
  • Logging like you've never seen

Passwords are one of the most common targets for hackers, so it’s imperative that your company enforce a strong password policy. This policy will not only define the requirements of the password itself but the procedure your organization will use to select and securely manage passwords.

5 Password Policy Best Practices

1. Use a password manager

One of the biggest complaints your users may voice about your password requirements is “I’ll never remember a password like that!”  The good news is that by using a password manager, they won’t have to. A password manager - also sometimes called a password vault - is a convenient way to store passwords securely without having to commit them to memory.  The basic idea is you only have to remember a single password - which in turn opens up access to the rest of your passwords. Popular tools in this space include 1Password, LastPass, and Dashlane.  

Many of these tools will plug right into your users’ Web browsers, so next time a user signs up for an online service, the password manager will offer up an extremely secure password such as B6KcwU}9wP7JKfunE8vpG2fYyaB, which will be saved automatically for future use.  This way, the user isn’t tempted to use one of the world’s worst passwords, such as passw0rd.

2. Password creation

Clearly define password complexity requirements - including uppercase letters, lowercase letters, and minimum password length. This is an area where organizations tend to get a bit carried away.  It’s natural to think that a longer password is better, so some system administrators increase password minimum length to 15 or 20 characters. According to the password guidance published by Microsoft, longer passwords are not always better.  Among the recommendations in the paper, Microsoft advises:

  • Passwords should contain a minimum of 8 characters
  • Use a unique password for each site
  • Use multifactor authentication (MFA) wherever possible

Conveniently, using a password manager allows users to easily create passwords that meet your organization’s requirements.  Most of these solutions also support MFA, so you can add another layer of security to your password protection as well.

3. Password protection

In addition to enforcing what password management tools your users should use, such as a password manager, your policy needs to outline the ways users should not store passwords as well.  In other words, getting users to configure a password manager is great, but if they store their master password on a sticky note tucked under a keyboard, that’s not great!

Consider the following guidance statements to include in your password policy:

  • Store passwords in the provided password management tool
  • Use a unique password for each online account/service
  • Passwords should be treated as confidential and not shared with anyone
  • Do not write passwords down on paper
  • If you suspect unauthorized access to your account or think your password may be compromised, change your password immediately

Additionally, make sure employees are only using password managers approved by the company.  To make the adoption of a password manager easier, most of these products will also integrate right into your Active Directory.  That way, you can easily share passwords and enable access control between various users and groups without having to configure a separate permissions structure.

4. Password rotation

Outside of being forced to pick new passwords, users generally loathe periodic password changes as well.  Many information security experts feel that regular password rotation actually encourages users to be less secure with their practices.  For example, if a user account password is Winter2018, the next time they’re forced to do a password change, they might pick Spring2018.  Or if users are currently forced to use 10-character passwords and the organization ups the minimum to 12, users with Password12 as their password will just use Password1234.  In other words, users tend to use the minimum amount of effort to meet the password requirements. Thus they are likely to pick weak passwords.  According to the Microsoft password guidance document referenced earlier, if strong and unique passwords are used, you should be able to eliminate the need for periodic user account password rotations.  Still, as a general practice, companies are rotating passwords every quarter or at least twice a year.

5. Other tools to consider

As you choose your password requirements and consider using tools like a password manager, you might also want to look into additional ways to streamline password use throughout your organization.  SSO (Single Sign-On) is a service that allows users to submit a username and password to a single portal and then be passed seamlessly to other services without having to re-authenticate. For example, you could set up SSO so that after logging into your directory system in the morning, users can check email, join Slack and manage timesheets without ever having to provide their credentials manually to any of those systems.  

As talked about earlier in this post, multi-factor authentication is a good complement to a strong password.  MFA is generally considered to be something you know (like your password) plus one of the following as an extra layer of protection:

Something you have

  • Text message
  • An app (such as Google Authenticator or Microsoft Authenticator)

Something you are

  • Retina scan
  • Fingerprint

Until someone creates a better solution, we will continue to use passwords to protect our most sensitive accounts and data.  A password policy, coupled with MFA, will help strengthen password requirements and make it much harder for attackers to breach our systems.  And because so much of our work life is online, not having a password policy in today’s age is simply negligent.


About the Author

, Security Engineer / Podcaster, is the president of 7 Minute Security, an information security consultancy in the Minneapolis area. Brian spends most of his days helping companies defend their networks.

Since 2004, Brian has also run the blog/podcast called 7 Minute Security, where he shares what he has learned about information security into short, 7-minute chunks.

StrongDM logo
💙 this post?
Then get all that StrongDM goodness, right in your inbox.

You May Also Like

Linux Commands Cheat Sheet: Basic, Advanced & More
Linux Commands Cheat Sheet: Basic, Advanced & More
This article explores essential Linux commands, ranging from navigation, file management, text manipulation, system maintenance, user management, process management and more.
PAM Was Dead. StrongDM Just Brought it Back to Life.
PAM Was Dead. StrongDM Just Brought it Back to Life.
In essence, legacy PAM solutions over-index on access. StrongDM uses the principles of Zero Trust to evaluate and govern every action, no matter how minor - where each command, query, or configuration change is evaluated in real-time against dynamic policies that adapt to the context of the user, the sensitivity of the action, and the prevailing threat landscape.
9 User Authentication Methods to Stay Secure
9 User Authentication Methods to Stay Secure in 2024
User authentication plays an essential role in securing networks and ensuring that only authorized users can access sensitive data. As our infrastructure transitions from traditional on-premises setups to cloud and hybrid environments, our authentication methods must continue evolving.
Cybersecurity Audit: The Ultimate Guide
Cybersecurity Audit: The Ultimate Guide for 2024
A cybersecurity audit is a comprehensive assessment of your organization's information systems, networks, and processes that identify vulnerabilities and weaknesses that cybercriminals could exploit. The audit also evaluates the effectiveness of your security controls, policies, and procedures and determines if they align with industry best practices and compliance standards.
How StrongDM Simplifies NIS2 Compliance for EU Organizations
How StrongDM Simplifies NIS2 Compliance for EU Organizations
The NIS2 Directive establishes comprehensive cybersecurity legislation across the European Union. Building upon its predecessor, the Network and Information Security (NIS) Directive, the goal of NIS2 is to standardize cybersecurity practices among EU Member States. Much like the General Data Protection Regulation (GDPR), NIS2 seeks to unify strategies and actions throughout the EU to fortify digital infrastructure against the escalating threat of cyberattacks.