Strong password enforcement is a critical responsibility for IT professionals, who must implement policies covering MFA, password length, login attempt limits, and tools like single sign-on to protect systems and guide user behavior.
Password Enforcement Policies
IT professionals have admin rights into a lot of different systems. Of course it's going to be really important that they have good credential management to make sure those systems are protected. But not only that — they're setting the policies for the rest of the users, and they're setting them on the different systems, and so it's going to be really important that they set the correct policy enforcement for passwords.
One thing you're going to want your users to do is MFA, using some sort of MFA for their accounts. It's just mandatory nowadays. In fact, cyber security insurance is requiring it — if you're going to get insurance you have to have it. So MFA is just mandatory nowadays.
Long passwords are important as well. That is one of the biggest things that you can do to promote good passwords: have longer passwords.
Also, exceeding the number of attempts. If somebody's hacking your system, you don't want them to be able to replay and retry a bunch of different passwords. You want them to be locked out if they are not successful at a certain point, so have some sort of limit to how many times they can attempt bad passwords.
Then also screening passwords, making sure that you're checking on what passwords your users are using. That means that maybe you're even running some cracking databases against your directory services, against your user accounts, to see if you can hack their accounts. Because let me tell you, just saying what the policies are and having no enforcement, or no way to check on your users, is actually not a good system. What you'll do is you'll put the policy out there, and a lot of them won't follow it — some of them will, but a lot of them won't follow it — and you'll run one of these screening passwords to find out what their passwords are, and you'll find that a lot of them are not following the rules. It'll take a while to actually get your users all on board with following the new rules.
Also, no regular password changes. This is a common misconception out there. In fact, when I'm filling out cyber security insurance, it's one of the most common questions that I get from the cyber security insurance: why are you not making your users change their passwords?
As I already mentioned, it is helpful to change your password, it creates some level of security. But the problem, what they found, is that when people change their passwords regularly they just do some sort of sequence, which is not effective as we already mentioned, or they just make a real simple password, or they write it down, or whatever the case. Making your users change their passwords creates bad password habits, and so they found it's not effective. The recommendation nowadays is don't change your passwords regularly, or don't make your users change their passwords regularly, because they won't manage it very well. History has shown that that's just the way that people are working.
Then allow copy and paste. This is where people are copying and pasting from a password manager. If you're not allowing them to copy and paste from a password manager, what they're going to have to do is manually type in these big long messages, and that gets to be a big pain. So what they're going to do is start shortening their passwords and start creating password habits that aren't very good. Allow copy and paste so they can use password managers.
I've stepped into IT departments before where the IT department was practicing really bad password habits and they were setting a precedence for other employees.
Number one, they were telling the employees what the password was. That's problematic, because now you're saying don't share your password, but here's a shared password.
The other thing is they were setting default passwords, and with these default passwords people don't change the default password — they just start using the default password. The impression that the employees get is, we're saying practice good passwords, but here's a password, and they get the impression that this is a good password. We need to establish a precedence of what is a good password.
Another thing that can really help is single sign-on. If you implement single sign-on, then it's much easier for the users to practice good password behaviors. They can create one really good secure password that logs them on to multiple devices. Single sign-on allows you to log in once but access a lot of different applications and a lot of different software, rather than having a different login for each one of those. When you have a different login for each one of those, that's when they start writing down passwords, when they start using more simple passwords — that's what promotes some bad behavior.
Another thing is that it's not enough just to take something away from somebody; you need to have some sort of enforcement. As an example, as we said, make sure you screen your passwords to make sure that users are using good passwords. But if you find repeat offenders doing the same thing over and over again, they're not going to change their habit unless something becomes painful, and so sometimes you have to enforce that. What that might look like is extra training: if they find that they're not able to create the proper passwords, then perhaps they need to go through the password training again.
And then the password reset process — just make sure you have good habits when you go through a password reset process, and that you're once again not training your users to have bad password behavior.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →