What is the best way to enforce password policies in your organization?

I went to a CyberSecurity conference here in Jacksonville and one of the things that was said was that 1. the longer the better and 2. instead of using a word, use a phrase. Instead of using Linkedin2023, use Ilovelinkedin2023.

Multifactor is a key for password enforcement. Strong password is not enough by itself since people tend to use the same password for everything. Password rotation is recommended!

Education and Training: Provide regular training to employees on the importance of strong passwords and how to create and manage them securely. Teach employees about phishing threats and social engineering tactics that may compromise passwords.

It has been proven that the longer the password the longer it takes to crack. Even adding a few extra characters can make a big difference. Besides length it needs to have upper and lower case, numbers, and special characters. A phrase of some kind is best. Also unless there is Single Sign-On (SSO) at the company there should be unique passwords for each application.

- Require minimum length, complexity including uppercase, lowercase, numbers and symbols - Set automated expiration like 90 days to ensure strong, unique passwords - Use a password manager with randomly generated, encrypted passwords - Configure systems to reject easily guessed passwords during setup - Offer just-in-time training on tips for secure passwords - Consider multifactor authentication with biometrics for critical systems - Audit passwords regularly against breaches and enforce forced resets as needed Strategically implementing policies strengthens security posture. #cybersecurity #informationsecurity #passwordmanager #dataprotection #techtraining

There is definitely a balance to usability and security compliance. It is important to have "buy-in" from stakeholders in the organization with an understanding that strong security measures are important. In some environments, password policy may be required to meet regulatory compliance. In any situation, you should implement a plan that is secure, usable, and cost effective that also involves some form of multi-factor authentication.

Creating effective password policies involves several key steps to ensure a balance between security and usability. Always be clear when defining password requirements such as complexity, passphrase usage, minimum length, expiration etc.

You need to have a balance for sure. The person that works in the mail room might have different requirements compared to a system administrator. It is possible and would make sense to have different policies for different groups in the organization. There should be a minimum set of rules that all have to follow but as you move to the C-Suite, Finance, IT, and other potential targets with access to sensitive information you will need stronger policies.

Policies should be evaluated by an IT Security team. There should also be audits done to ensure that everybody is complying with the new policy.

Once the password policy is in place in an environment, there should be constant monitoring of it to make sure there is no denial of services or leakage of information that can compromise the security and assets in the environment. The communication in this scenario between all the stakeholders is key.

Updating policies can be a tough task. The reason is you have to ensure that everybody starts to follow the new policy. For that there should be proper communication ahead of time to let people know the change is coming. It has to be over the span of a few weeks to let people adjust to the coming change as well. Once they are ready there has to be a roll out that forces the update on all employees. The roll out should NEVER happen before the weekend or some type of holiday break.

Can be quite difficult. You start with assessments and this involves checking the current policy and dealing with factors like user compliance, security incidents, feedback, and emerging threats for all involved. Then roll out new password policies, educate them, wait for everyone to learn and adjust etc. It's a hard process but it's worth it.

Policies should be communicated via email, signage around the office (if not all remote), in meeting by managers, and communications from the C Suite. It might sound annoying or silly but there can never be too much communication when it comes to password policy changes. The communications should be short yet informative. If you send a message out that is multiple paragraphs long it won't be read. Instead a short communication sent out in multiple parts is the best way to go. It allows people to take it in small chunks and stay focused with any questions they might have while preventing them from being overwhelmed with information.

Create easily accessible and understandable documentation outlining the password policies. Then share to everyone. Conduct interactive training sessions or workshops to educate users. Email Create visual aids such as infographics, posters, or charts that summarize the key elements of the password policies. It's easy for some to get messages when they're visualized. Post the updated password policies prominently on internal portals or intranet sites where employees can easily access them. One on one sessions. Creating Feedbacks also helps a lot. People will talk about their confusions or concerns which help eliminate any lingering problems. Provide password policy information in multiple languages.

Well there is also the need to run periodic scans on systems, to ensure the compliance controls implemented are actually working. Periodic baseline-compliance scans using tools like Nessus, may be run on systems to identify failed controls including the password controls. Post scanning, failed controls need to be analysed and patched.

Another thing to consider is testing how effective the controls were implemented. Penetration tests, especially Red Teaming, can highlight weak passwords and the real impact they pose in an environment. By showing executives and upper management the theory of, "this is the impact we were able to prove by exploiting weak passwords in the environment" will likely increase the enforcement of existing password policies.

Enforcing password policies requires communication. You should inform and educate users and stakeholders on why your password policies are important and beneficial. To do this, you should create a password policy document that is clear, concise, and accessible.