Building a Strong Password Policy

Despite years of security awareness campaigns, "123456" and "password" still rank among the most commonly used passwords worldwide. According to the Verizon Data Breach Investigations Report, compromised credentials are involved in the majority of hacking-related breaches.

Why Password Policies Matter

A strong password policy is not about making life difficult for employees — it is about protecting the entire organisation from a single point of failure. One compromised password can give attackers access to email, internal systems, customer data, and financial accounts.

Key Elements of a Modern Password Policy

Length Over Complexity

The old approach of requiring uppercase, lowercase, numbers, and special characters has been shown to be counterproductive. It leads to passwords like "P@ssw0rd1!" — technically compliant but trivially easy to crack.

Instead, encourage passphrases — four or more random words strung together. "correct-horse-battery-staple" is far more secure than "Tr0ub4dor!" and significantly easier to remember.

Minimum length should be 12 characters, with 16+ recommended for privileged accounts.

Multi-Factor Authentication (MFA)

MFA is the single most effective measure to prevent account compromise. Even if a password is stolen, the attacker cannot access the account without the second factor.

• Authenticator apps (Google Authenticator, Microsoft Authenticator) are the recommended second factor.
• SMS-based codes are better than nothing but vulnerable to SIM-swapping attacks.
• Hardware keys (YubiKey, FIDO2) provide the highest level of protection for sensitive accounts.

Every organisation should enforce MFA for all user accounts, not just administrators.

Password Managers

Expecting employees to create and remember unique, strong passwords for dozens of services is unrealistic. Password managers solve this by generating and storing complex passwords securely.

Recommended approach:

• Provide a company-approved password manager.
• Train employees on how to use it.
• Require its use for all work-related accounts.

What Not to Do

• Do not force regular password changes unless there is evidence of compromise. Forced rotation leads to predictable patterns (Password1, Password2, Password3...).
• Do not ban password pasting — this discourages password manager use.
• Do not impose arbitrary complexity rules that encourage weak workarounds.

Implementing Your Policy

• Communicate clearly — Explain why the policy exists, not just what it requires.
• Provide tools — Deploy a password manager and MFA solution before enforcing the policy.
• Train your team — Short, practical training sessions are more effective than lengthy policy documents.
• Monitor and adapt — Use breach monitoring to detect compromised credentials and act quickly.

Conclusion

A strong password policy combined with MFA and a password manager dramatically reduces the risk of credential-based attacks. The goal is not to burden employees but to give them the tools and knowledge to protect themselves and the organisation.