Password policy best practices

Password policies explained

A password policy defines the requirements and rules that users must follow when setting up and managing their passwords within an organization. These rules can vary between organizations and include criteria such as password length, complexity, age, and history. By enforcing a password policy, organizations ensure that users create strong passwords, reducing the risk of breaches caused by password-related attacks.

Essential elements of a good password policy

A stringent password policy is crucial for ensuring the safety and integrity of organizational assets and user data. The essential elements of a good password policy are given below.

• Minimum password length: Enforce a minimum length for passwords (for example, at least 12 characters), as longer passwords are harder to crack.
• Password expiration: Implement a password expiration policy that requires users to change their passwords regularly (for example, every 90 days). This helps in cutting down the risk of long-term access from compromised passwords.
• Password complexity requirements: Encourage the use of a mix of uppercase letters, lowercase letters, numbers, and special characters. This complexity makes it difficult for attackers to guess or crack passwords.
• Password history: Enforce a policy that prevents users from reusing their previous passwords within a certain number of cycles (for example, the last five passwords). This helps thwart the risk of using compromised credentials.
• Multi-factor authentication (MFA): By implementing MFA, you are adding an extra layer of security to your account. This requires a second form of verification, such as a text message code or an authentication app, in addition to your password. Using a factor you possess (for example, YubiKey) or something inherent to you (for example, biometrics) ensures that only you can access your accounts.
• Account lockout mechanisms: Set up account lockout procedures after a specified number of failed login attempts. This helps to keep brute-force attacks at bay by limiting the number of guesses a threat actor could make.

Password policies and compliance

Compliance regulations are regularly updated based on insights from ethical hackers and past security breaches. Here’s what these regulations recommend when it comes to creating a good password policy.

Do's and dont's while setting up password policies

Effective password policies help in guarding organizational resources while ensuring users can easily adhere to the guidelines. The key practices to follow and common pitfalls to avoid when setting up password policies are given below.

• Do not use commonly used passwords, like "Password," your name, or a dictionary word. Such passwords can easily be compromised by attackers using a dictionary attack
• Do not use keyboard sequences or patterns in your password.
• Do not use default passwords as these are the first ones that attackers will try in password-related attacks.
• Do not use easily available information, like your date of birth, your phone number, or your license plate number. An attacker could be anyone, even someone who knows you well. Their instinct would be to use information associated with you to attempt a breach.
• Use passkeys wherever possible.
• Do not reuse passwords across multiple accounts, as it could lead to credential stuffing attacks.
• Do not share passwords, even with your family or closest friends. You can never be sure who might turn against you.
• Do not write your passwords anywhere, be it online or offline. If you find it difficult to remember your passwords, use a password manager instead.
• Change all your passwords every 90 days. Make sure you do not set a password that was already set by you in the past.

Implement stringent password policies with ADSelfService Plus

ADSelfService Plus is an identity security solution with MFA, SSO, and password management capabilities. It provides a Password Policy Enforcer feature that allows you to enforce custom password policies that seamlessly integrate with AD's built-in password policies. These custom policies offer more granular control than AD natively provides, including intricate settings such as restrictions on custom dictionary words, palindromes, and character repetitions. ADSelfService Plus also integrates with Have I Been Pwned to help prevent your users from using breached passwords. Additionally, by implementing MFA alongside a stringent password policy, you can further enhance security, ensuring that even if passwords are compromised, unauthorized access is still prevented.

People also ask