Password policies have changed significantly in recent years. The old advice about complex passwords with special characters and frequent changes has been updated based on research into how people actually behave. Here's what effective password policies look like today.
What's Changed in Password Best Practices
Old Thinking
Require complex passwords with uppercase, lowercase, numbers, and symbolsForce password changes every 30-90 daysPrevent any password reuseNew Thinking (NIST Guidelines)
Focus on length over complexityDon't require periodic changes unless there's evidence of compromiseCheck passwords against known breached password listsRequire multi-factor authenticationWhy the Change?
Research showed that complex password requirements often backfired:
Users created predictable patterns like "Password1!" or "Company2024!"Frequent changes led to weaker passwords and more help desk callsPeople wrote down complex passwords they couldn't rememberElements of an Effective Password Policy
Length Over Complexity
Longer passwords are harder to crack than shorter complex ones:
Minimum 12-14 charactersAllow (but don't require) complexityConsider allowing passphrasesMulti-Factor Authentication
MFA is non-negotiable for modern security:
Something you know (password)Something you have (phone, security key)Something you are (biometric)Even if a password is compromised, MFA prevents unauthorized access.
Password Managers
Encourage or require password managers:
Generate strong, unique passwords for every accountStore passwords securelyShare passwords safely when neededReduce password reuse across accountsAccount Lockout and Monitoring
Protect against brute force attacks:
Lock accounts after failed attemptsMonitor for suspicious login activityAlert on logins from unusual locationsImplementation Tips
Don't Change Everything at Once
Rolling out a new password policy requires planning:
Communicate the changes and rationale to staffProvide training on password managers if introducing themSet up MFA infrastructure before requiring itGive employees adequate time to complyMake It Easy to Do the Right Thing
If security is inconvenient, people will find workarounds:
Provide approved password managersMake MFA enrollment simpleOffer support for those who struggle with changesHandle Exceptions Thoughtfully
Some systems may not support modern authentication:
Document exceptions and their risksImplement compensating controls where possiblePlan for upgrading or replacing legacy systemsTrain Your Team
Technical controls aren't enough:
Explain why these practices matterTeach recognition of phishing attemptsCreate a culture where security is everyone's responsibilityMeasuring Success
Track metrics to ensure your policy is working:
Password-related help desk ticketsSecurity incidents involving credentialsMFA adoption ratesCompliance with policy requirementsAn effective password policy balances security with usability. The goal is to make it easy for employees to follow good practices while making it hard for attackers to compromise accounts.