Security Password Policies and Alternatives

What it is

A password policy is a set of rules that makes passwords harder to attack and easier to manage.

Passwords are the oldest and most common way to prove identity. They are also one of the weakest, because people pick guessable ones, reuse them and write them down.

This topic covers what a good policy contains, and the alternatives that go beyond a password alone: multifactor authentication, digital certificates and biometrics.

How it works

Policy rules harden the password itself, and extra factors protect the account if the password leaks.

Password management

Management covers how passwords are created, stored, changed and retired.

• Unique passwords for each system, so that a leak in one place does not open every door.
• Safe storage. Passwords should never be written on notes or kept in plain files. A password manager can generate and store strong, unique passwords for each account.
• No sharing. Every person has their own account, so actions can be traced.
• Change on suspicion. Change a password at once if it may have been exposed.
• Default passwords on new devices must be changed before the device goes into service.
• Password history, which stops people from reusing recent passwords.
• Account lockout after repeated failed attempts, which slows guessing.

Policies have also changed over time. Forcing frequent changes often pushes users to make small, predictable changes such as adding a number at the end.

Many modern recommendations favour long passwords that are changed only when there is a reason, such as a suspected breach. NIST guidance, for example, advises against forced periodic changes without a reason.

Password complexity

Complexity rules make a password harder to guess or crack. The most common ones are:

• a minimum length
• a mix of uppercase and lowercase letters, numbers and symbols
• no dictionary words, names or dates of birth
• not the user name or something obviously linked to the user

Of these, length matters most. Each extra character multiplies the number of possible passwords. A long passphrase, made of several unrelated words, can be both strong and easier to remember than a short, jumbled password.

Complexity helps against brute force attacks, which try every combination, and dictionary attacks, which try likely words. Neither is effective against a long, random password.

Alternatives and additions to passwords

A password is something you know. Authentication can use up to three kinds of proof:

Multifactor authentication (MFA) requires proof from two or more different factors. For example, a password plus a code from a phone app. Even if an attacker steals the password, they still lack the second factor.

Using two passwords is not MFA, because both are the same factor. A one-time password (OTP) is a code that works only once or for a short time, often shown by an app or sent as a message. Sending codes by text message is convenient but weaker than an app or a hardware token.

Digital certificates prove identity using public key cryptography instead of a password. A certificate binds a name to a public key and is signed by a trusted certificate authority (CA). The holder keeps the matching private key secret.

Certificates are used for web servers with HTTPS, for VPNs, for wireless authentication such as EAP-TLS and for devices that need to prove who they are without a person typing anything. Their drawbacks are the work of issuing, renewing and revoking them, which needs a supporting system called a public key infrastructure (PKI).

Biometrics use a physical trait. Fingerprints and face recognition are the most common. They are convenient, since nothing needs to be remembered, but they have drawbacks.

A biometric cannot be changed if it is stolen. The systems can also make mistakes: a false rejection blocks a real user, and a false acceptance lets in the wrong person. For that reason, biometrics are often used together with another factor.

Putting the pieces together

A strong approach combines these ideas. A user signs in with a long, unique password, held in a password manager, and then confirms with a code from a phone app.

Laptops and network devices prove themselves with certificates. The most sensitive rooms use a badge and a fingerprint.