Passwords are critical security barriers between controlling access and letting anyone run ragged over your network. Because the uses of passwords and the protections surrounding them have changed dramatically over the years, every organization seems to have a different password security policy
Rather than cut
Passwords are critical security barriers between controlling access and letting anyone run ragged over your network. Because the uses of passwords and the protections surrounding them have changed dramatically over the years, every organization seems to have a different password security policy
Rather than cut and paste a 13-year-old policy you found on a government website, it makes sense to think about what goes into a good password security policy and why you should put it there.
A password security policy is there to reduce risk, which means organizations can only write a good policy by thinking about the risk they are trying to reduce. Of course, you can always say to yourself, "I won't think about risk; I'll write a policy with overkill." That has two problems: the first is that the more difficult the policy is to understand or comply with, the more likely users are to work around the policy. So by making an insanely "overly secure" policy, you're actually giving people a reason to act insecurely.
The second problem with overkill policies is that they indicate the information security staff isn't doing its job. If IT teams won't look at security risks and try to find appropriate compensating controls with something as simple as a password policy, how can they expect anyone in the company to respect IT's professional judgment about other areas of information security?
The risks of implementing a poor password security policy
Let's look at risks in a little more depth to see how password security policies should reflect the risks to the organization. Your three biggest risks with passwords are intentional password sharing, password theft or loss, and password guessing. People sharing passwords to get their jobs done (and sometimes for other reasons), and then not immediately changing them is one bad practice, but passwords also can make their way into the wrong hands through theft: shoulder surfing, social engineering, sticky notes on people's monitors, password reuse across systems and we