A password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly. A password policy is often part of an organization's official regulations and may be taught as part of security awareness training. The password policy may either be advisory or mandated by technical means.
Contents |
Typical components of a password policy include:
Many policies require a minimum password length, typically 8 characters. Some systems impose a maximum length for compatibility with legacy systems.
Some policies suggest or impose requirements on what type of password a user can choose, such as:
Other systems create the password for the users or let the user select one of a limited number of displayed choices.
Some policies require users to change passwords periodically, e.g. every 90 or 180 days. Systems that implement such policies sometimes prevent users from picking a password too close to a previous selection.
This policy can often backfire. Since it's hard to come up with 'good' passwords that are also easy to remember, if people are required to come up with many passwords because they have to change them often, they end up using much weaker passwords; the policy also encourages users to write passwords down. Also, if the policy prevents a user from repeating a recent password, this means that there is a database in existence of everyone's recent passwords (or their hashes) instead of having the old ones erased from memory.
The human factors aspects of passwords must also be considered. Unlike computers, human users cannot delete one memory and replace it with another. Consequently changing a memorized password is very difficult, and most users resort to choosing a password that is easy to guess. Users are often advised to use mnemonic devices to remember complex passwords. However if the password must be repeatedly changed, mnemonics are useless because the user would not remember which mnemonic to use.
Requiring a very strong password and not requiring it be changed is often better. However, this approach does have a major drawback: if an unauthorized person acquires a password and uses it without being detected, that person may have access for an indefinite period.
It is necessary to weigh these factors: the likelihood of someone guessing a password because it is weak, vs. the likelihood of someone managing to steal, or otherwise acquire without guessing, a password.
Password policies often include advice on proper password management such as:
Password policies may include progressive sanctions beginning with warnings and ending with possible loss of computer privileges or job termination. Where confidentiality is mandated by law, e.g. with classified information, a violation of password policy could be a criminal offense. Some consider a convincing explanation of the importance of security to be more effective than threats of sanctions.
The level of password strength required depends, in part, on how easy it is for an attacker to submit multiple guesses. Some systems limit the number of times a user can enter an incorrect password before some delay is imposed or the account is frozen. At the other extreme, some systems make available a specially hashed version of the password so anyone can check its validity. When this is done, an attacker can try passwords very rapidly and much stronger passwords are necessary for reasonable security. (See password cracking and password length equation.) Stricter requirements are also appropriate for accounts with higher privileges, such as root or system administrator accounts.
Password policies are usually a tradeoff between theoretical security and the practicalities of human behavior. For example:
A 2010 examination of the password policies [2] of 75 different web-sites concludes that security only partly explains more stringent policies: monopoly providers of a service (e.g. government sites) have more stringent policies than sites where consumers have choice (e.g. retail sites and banks). The study concludes that sites with more stringent polices "do not have greater security concerns, they are simply better insulated from the consequences from poor usability."
Other approaches are available that are generally considered to be more secure than simple passwords. These include use of a security token or one-time password system, such as S/Key.
The more complex a password policy the harder it may be to enforce, due to user difficulty in remembering or choosing a suitable password.
Most companies will require users to familiarise themselves with any password policy, much in the same way a company would require employees to be aware of Health & Safety regulations, or building fire exits, however it is often difficult to ensure that the relevant policies are actually being followed.