Overview
Password policies shape how strong users' passwords are, balancing security against usability. Modern guidance has shifted in important ways. This lesson covers password policies.
Learning objectives
- Explain the goal of password policies.
- Describe modern password-policy guidance.
- Balance strength against usability.
Core concept
A password policy sets rules for acceptable passwords, aiming to ensure they are hard to guess. Modern guidance (reflecting current best practice) emphasizes: favoring length over arbitrary complexity, encouraging passphrases, screening against known-breached/common passwords, and removing counterproductive rules — notably not forcing frequent periodic changes (which leads to weak, predictable variations) and avoiding rigid composition rules that frustrate users without adding real strength. The goal is genuinely strong, usable passwords, ideally complemented by MFA.
How it works
Effective policy encourages long passphrases and blocks weak/known-breached passwords (checking new passwords against lists of compromised ones), rather than mandating arbitrary complexity or frequent rotation. Frequent forced changes are now discouraged because users respond with minor, guessable modifications; changes should instead be triggered by evidence of compromise. Combined with MFA and secure storage, a modern policy meaningfully improves account security while remaining usable. Assessing a policy checks whether it follows this guidance or relies on outdated, counterproductive rules.
Practical example
An assessment reviews an application's password policy and finds it forces monthly password changes and requires rigid complexity but does not screen against breached passwords. Per modern guidance, the recommendation is to drop mandatory periodic rotation, add breached-password screening, encourage length/passphrases, and pair with MFA. This shifts the policy from a frustrating, weakly-effective one to a genuinely stronger, more usable design.
Cybersecurity relevance
Password policy directly affects real-world account security. Outdated policies (forced frequent rotation, arbitrary complexity) can reduce security by encouraging predictable passwords and harming usability, while modern policies (length, passphrases, breach screening, no forced rotation, plus MFA) are more effective. Assessments should evaluate policies against current guidance. For defenders, adopting modern policy is a high-value, low-cost improvement. This complements secure storage and MFA — strong passwords, well stored, with a second factor.
Common mistakes
- Forcing frequent periodic password changes, driving weak, predictable variations.
- Emphasizing arbitrary complexity over length/passphrases and skipping breached-password screening.
- Treating policy as a substitute for MFA and secure storage rather than a complement.
Key takeaways
- Password policies aim for hard-to-guess passwords; modern guidance favors length/passphrases, breached-password screening, and removing forced periodic rotation and rigid complexity.
- Frequent forced changes are counterproductive (predictable variations); change on evidence of compromise instead.
- Modern policy improves strength and usability and complements MFA and secure storage; assess policies against current guidance.
Check your understanding
- Why is forcing frequent password changes now considered counterproductive?
- What modern practices make a password policy both stronger and more usable?