A Password Policy mandating compliance with industry standards for password creation and use should be implemented and enforced on all identity platforms in the organization's environment.

Control Type: Administrative

Control Function: Preventive

Description: Passwords are frequently targeted by adversaries who have devised numerous schemes to compromise them and exploit them for nefarious purposes. To combat this, users need increasingly stronger passwords. What constitutes a “strong password” can be very confusing to users. To enforce standard requirements for strong passwords, organizations need to draft a password policy that clearly explains expectations for user password creation and use. The policy must be distributed to all employees, and additional training and assistance must be provided if needed. Businesses also need to import the policy into their information systems to enforce the standards specified in the policy.

The standard requirements for user account passwords have generally been: 

  • Minimum password length of 12 to 15 characters. 
  • Enable Password Complexity. 
  • Set a maximum password age of 60 to 90 days, with 30 days preferred for high-impact resources. 
  • Enforce password history.
  • Enforce a minimum password age of at least 15 days. 

Recently, NIST SP 800-63-4 presented a new standard for password policies that completely challenged the previously accepted password standards. The NIST revisions made the following major changes:

  • Do not require password changes unless an account is believed to be compromised. 
  • Enforce Multifactor Authentication (MFA) for all accounts. 
  • Set a minimum password length of 8 characters without any other complexity requirements. 
  • Use password filtering to block the use of insecure passwords.
    • No passwords which have been found in mainstream password dumps and breaches.
    • No passwords that use only dictionary words.
    • No passwords made of repetitive or sequential characters like abcdefg123456.
    • No passwords that contain direct references or clues to the user’s identity.

These recent standards also emphasize using passphrases as a method of implementing strong passwords. A passphrase is an easily remembered phrase that serves as a mnemonic for complex passwords. It is up to the organization itself to decide on which password standard is the best fit for its environment.