TechKnowSurge
NIST 800-53 IA-5 NIST 800-53 AC-7 CompTIA Security+ 4.6 ISC2 CISSP 5.2 K0830 K0742 NIST CSF PR.AA-01 CompTIA Security+ 5.1
TechKnowSurge Catalog Videos IAM Policies and Enforcement
VideoSecurityFree

IAM Policies and Enforcement

Effective password and identity management policies balance security requirements with what users can realistically follow, combining measures like MFA, longer passphrases, account lockouts, password managers, and single sign-on. Security professionals must set enforceable standards, train users on the reasoning behind them, and continuously adapt to current industry guidance.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Password policies that were considered best practice decades ago have not kept pace with how users actually behave or how attackers actually operate, yet many organizations continue enforcing those same outdated standards. Mandatory complexity requirements tend to produce predictable substitutions rather than genuinely stronger credentials, forced rotation cycles lead users to increment a number at the end of a familiar password, and cumulative requirements — length, complexity, uniqueness per account, and regular changes all at once — create a burden that drives users toward writing passwords down or choosing ones that offer little real protection. The result is a security posture that looks rigorous on paper but fails in practice. A well-designed identity and access management policy shifts focus toward controls that are both more secure and more sustainable for end users. Multi-factor authentication should be treated as a baseline requirement. Longer passphrases, potentially built from several unrelated dictionary words, are harder for automated tools to crack and easier for people to remember than short, complex strings. Account lockout policies limit brute-force attempts, automatic screen locking reduces exposure from unattended workstations, and allowing copy-and-paste functionality enables the use of password managers with machine-generated credentials. Single sign-on reduces the number of separate credentials users must manage, lowering the temptation to reuse or simplify passwords across systems. Default and temporary passwords must always be replaced immediately, and the IT department itself must model the standards it expects from users. Policy alone is insufficient without enforcement and education. Technical controls such as group policy should be used to ensure standards are applied consistently rather than left to individual compliance. Users need training that covers not only what the requirements are but why they exist and what the consequences of ignoring them look like. Regular testing and auditing confirms whether training is translating into actual behavior. Because the threat landscape and research-backed recommendations continue to evolve, security professionals must stay current with guidance from authoritative sources and be prepared to revise organizational policies accordingly rather than defaulting to approaches that may no longer reflect what actually works.

What you'll learn

What's covered

Password & Identity Management Policies

Aligned to

NIST 800-53
IA-5 Authenticator Management
AC-7 Unsuccessful Logon Attempts
CompTIA Security+
4.6 Given a scenario, implement and maintain identity and access management.
5.1 Summarize elements of effective security governance.
ISC2 CISSP
5.2 Design identification and authentication strategy
NIST CSF
PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization.

Key terms

Multi-Factor Authentication
MFA
An authentication method that requires users to provide two or more verification factors to gain access.
Identity and Access Management
IAM
A framework of policies and technologies that ensures the right users have appropriate access to resources.
Brute Force Attack
An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Account Lockout
A security control that disables a user account after a defined number of failed login attempts to prevent unauthorized access.
Password Manager
A secure application that stores and manages a user's passwords in an encrypted vault, requiring only one master credential for access. Password managers enable users to maintain strong, unique passwords for every account without memorizing them.
Single Sign-On
SSO
An authentication process that allows a user to access multiple applications with one set of credentials.
Security Policy
A formal document that defines an organization's security goals, rules, and responsibilities.

Topics

Identity Access Management Password Policy Multi Factor Authentication Account Lockout Password Managers Single Sign On Cybersecurity

Transcript

We need to set reasonable expectations and policies for our end users, especially when it comes to password management and identity and access management.

Here's a comic strip from 20 years ago. Essentially what it is, is the top part is talking about how we've set an expectation for really stupid passwords — passwords that are really easy for a computer to guess but also really hard for users to remember — and that there is a much better method out there that makes it much harder for computers to guess and much easier for humans to remember. However, the thing is, here we are 20 years after this comic strip and we still don't get the point. We still are focusing in on the wrong areas.

So our job as system administrators and security professionals is to set reasonable policies, policies that people can follow, and then train them on what they need to follow — but also how come they need to follow it, what are the downsides if they don't follow those reasonable policies — and then do a ton of testing to make sure that people are actually following through with what you're training them to do.

Where our password requirements go wrong

Now what I found is that a lot of times we require our users to have a password of a certain length. Many times that length isn't adequate enough, though, and so that's one of the areas that I think we're always a little weak on, or a lot of times a little weak on.

We also require them to have complexity. Well, when you require complexity, a lot of times they'll just tag something on the end of a word, or they will do common substitution, which doesn't improve security all that much.

And then we require some sort of changing of passwords. Well, what happens is if you require your users to change passwords, they'll just start out with a 01, and then the next one will be a 02, and then a 03, which really defeats the purpose of why we're changing the password.

And then we require them to have a password per account, which I really firmly believe is really important. But the thing is, when you combine all of these you start creating this really hard level that a lot of users can't follow. So then they start writing things down, or start making really simple passwords like this, that really don't contribute to security much at all.

What to enforce

So when you are enforcing passwords, you want to make policies on your network. You want to use things like group policy to enforce this. You want to set up things on your network to help enforce this.

So what do we want to set up? Well, MFA definitely is a necessity. I would vote for longer passwords rather than some sort of complexity, because when you start adding complexity they just bypass things. A longer password — generally people can come up with some sort of password, a longer password phrase or something that is more unique, using maybe four, five, six dictionary words if you train them to use those right.

And then have a maximum number of attempts that they can have. This really stops it if somebody's trying to hack the system, hack the account — then they can only try so many passwords before they're locked out of the system.

Also, if they walk away from their computer we want it to lock, so make sure you have screen passwords on your systems.

Don't make your users change their passwords regularly, because that's going to promote bad password habits. What we found is that it doesn't improve security. So we probably should be changing our passwords, or at least certain passwords, on a regular basis, but don't make your users regularly change their passwords, because that can be problematic.

And then make sure you allow copy and paste, and then start rolling out things like password managers, so people can copy and paste from a password manager and then have machine generated passwords.

Don't ever use temp passwords. That is, if you get a piece of equipment, or if you get software and you set it up, change that default password to something else.

You also want to help your users out by setting up single sign-on. This is going to equip them with tools so that they can have a more complex password, a password that is much more secure, and then they can log into the system and have access to many other systems with single sign-on.

Setting the precedent, and enforcing it

Also, as an IT department, you need to make sure you're setting the precedence. All too often I've been a part of IT departments that have set some sort of generic simple password that is the same for a lot of different users, and those users either don't change those passwords, or at the very least you're setting a precedent for what passwords look like. So make sure that you have more complex passwords, and find out ways that you can get around giving even these passwords out. You want them to set the password.

Which brings it to the password reset process. Make sure in all your systems you have a fairly easy password reset process that they can go through.

And then also make sure you're doing some sort of enforcement, because if you just put the policies out there but don't enforce them, then that's going to be problematic as well — your users are not going to have any motivation to not do terrible passwords, and many of them will still continue to do terrible passwords.

Keep up with current recommendations

Now the thing is, a lot of people are stuck into recommendations that happened 30 years ago, and things have changed since then and things will continue to change. So although I've gone over some highlights of what is recommended now, really you need to be researching what is recommended at any given time and adapt to it. So we need to adapt these policies to what are the most recent recommendations that they find is going to be the best way to implement security on your network.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →