Password Policies

A password policy is a set of rules an organisation writes to control how passwords are created and how they are looked after once in use. It turns vague advice such as "pick a good password" into clear checks that staff can follow and that a system can enforce.

Rules for creating passwords

A password is strong when it is long, because every extra character multiplies the number of guesses an attacker must make. It should also mix character types — capitals, lower-case letters, digits and symbols — so that guessing software cannot assume a narrow set of possibilities. It should avoid personal information anyone could find out, such as a favourite film or a street name, and avoid predictable sequences that attackers try first.

Strong passwords are also never reused across accounts. If one service is breached, a reused password hands the attacker the keys to every other account it opens, so a policy bans recycling and requires a fresh password each time.

Rules for protecting passwords

• Keep every password secret and never share it, even with a trusted colleague or IT staff.
• Do not write passwords down on paper, sticky notes or an unprotected file where someone could read them.
• Shield the keyboard or screen when typing so nobody can read the password over your shoulder.
• Change passwords regularly, and immediately if a breach is suspected, so a stolen password stops working.

Tools that support a policy

A password generator produces a random string of characters that is not a recognised word, so dictionary-based attacks fail and the user is not tempted to invent something guessable. A password checker tests a password against the policy — its length, its character mix and whether it appears in known lists of leaked passwords — and rates it weak or strong, so that a weak one can be replaced before it causes a problem.