A robust password policy is the foundation of any organisation’s cyber resilience. Weak or reused credentials are among the top causes of data breaches and financial loss. This guide delves deeper into proven techniques for creating and managing high-entropy passwords, and how this can be complemented with additional layers of security.
Why Passphrases Outperform Traditional Passwords
Modern password cracking tools try millions of combinations per second. Increasing length by using a passphrase (multiple unrelated words) multiplies the number of possible combinations far more than adding a single symbol or digit to a short word.
Encourage staff to visualise a vivid scene: imagine a ‘VelvetPianoLantern’ or “CactusRocketMarathon.’ These can be memorised far better than random strings of letters and numbers.
Complex but Convenient
While length is paramount, complexity must not be overlooked. A purely lowercase passphrase can still be vulnerable to word-list attacks. Layer in:
- Mixed casing at irregular positions (e.g.
vElvEtpIanOlaNtErn). - Internal numbers and symbols (e.g.
v3lV3t!p1An0#LanT3rn). - Avoid predictable patterns, such as placing symbols only at the end.
This approach balances complexity with memorability.
Managing Passwords
Sharing passwords via email, spreadsheets or physical paper is a recipe for disaster. A dedicated password manager, such as 1Password, which is designed for teams can:
- Generate unique, random passwords for every service – no reuse.
- Store credentials in an encrypted vault, accessible only to authorised roles.
- Log access and changes, providing an audit trail for compliance (e.g. GDPR, ISO 27001).
- Automate secure sharing, so contractors or temporary staff receive only the credentials they need.
Passwords Alone are not Enough
Passwords alone can be phished or exposed in a breach. Multi-factor authentication (MFA) adds a second layer of security:
- Authenticator apps (Authy, Google/Microsoft Authenticator) generate time-based one-time codes.
- Hardware tokens (YubiKey, other FIDO2 devices) provide phishing-resistant security.
- Backup codes must be stored securely in a separate vault or printed and locked away.
Multi-factor authentication should be mandated wherever possible.
Embedding Best Practice
A strong policy needs continual reinforcement:
- Onboarding sessions: Introduce password and 2FA standards on day one.
- Refresher training: Quarterly micro-learning modules with real-life breach case studies.
- Automated breach monitoring: Subscribe to alerts (e.g. Have I Been Pwned) for your corporate domains and require immediate resets for exposed credentials.
- Periodic access reviews: Quarterly audits of vault users and shared items to remove stale or unnecessary access.