Put It in the Policy or Leave It Out?

About this interactive

The IAM Policies and Enforcement lesson asks for rules people can actually follow, then training on why, then testing and enforcement. Put in the policy: multifactor authentication. Longer passwords and passphrases instead of complexity rules. A maximum number of failed attempts before the account locks, so guessing stops. Screens that lock when a computer is left alone. Password managers, with copy and paste allowed so machine-made passwords can be used. Default passwords on new equipment and software changed before use. Users setting their own password instead of IT handing out one generic password. Single sign-on, an easy password reset process, and enforcement, for example through Group Policy. Leave out: forced regular password changes, which push people into Password01, Password02. Complexity rules, which lead to a symbol tagged on the end or a common substitution. One shared starting password set by IT. Blocking paste, or banning password managers. A policy nobody checks. The lesson's last point: recommendations change, so check the current ones (such as NIST SP 800-63B) rather than rules from decades ago. A quick test for each card: will this rule make passwords stronger in practice, or push people into a habit that makes them weaker?

What you'll learn

Decide which password and sign-in rules belong in an organization's policy today: a second factor, long passphrases, a limit on failed attempts, screen locks, password managers with paste allowed, changed defaults and an easy reset
Recognize rules that push users into weak habits and leave them out: forced regular changes, complexity rules, a shared starting password, blocked paste

Aligned to

CompTIA Security+

4.6 Given a scenario, implement and maintain identity and access management.

5.1 Summarize elements of effective security governance.

NIST 800-53

IA-5 Authenticator Management

AC-7 Unsuccessful Logon Attempts

Key terms

Account Lockout: A security control that disables a user account after a defined number of failed login attempts to prevent unauthorized access.
Default Password: A generic, preset password assigned to a device or account during setup that has not been changed by the user, representing a significant security vulnerability.
Multi-Factor Authentication: An authentication method that requires users to provide two or more verification factors to gain access.
Password Manager: A secure application that stores and manages a user's passwords in an encrypted vault, requiring only one master credential for access. Password managers enable users to maintain strong, unique passwords for every account without memorizing them.
Security Policy: A formal document that defines an organization's security goals, rules, and responsibilities.

Topics

Passwords Policy Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →