· 1 min read
Many password policies fail because they ask for the impossible: a different complicated password for every system, changed every month. People respond by writing them down or adding a number to the end.
A policy that fits on one page
- Use a password manager for work accounts. It creates and remembers a different strong password for every site.
- Choose one long passphrase for the password manager itself, at least 14 characters, that you use nowhere else.
- Switch on the second sign-in step for email, banking and any admin account.
- Never share a login. Give each person their own account, so a leaver can be removed on their last day.
- Change a password when you have a reason to: a suspected leak, a lost device, or a person leaving. Not on a fixed calendar.
Why length beats complexity
A long phrase of ordinary words is both easier to remember and harder to guess than a short string of symbols. What really weakens passwords is reuse: when one site is breached, attackers try the same details elsewhere.
What the business must do
- Provide the password manager and show people how to use it.
- Turn on the second sign-in step centrally, so it is not optional.
- Remove accounts of people who leave, on the same day.
- Check from time to time which accounts nobody uses.
General information. It is not legal or professional advice for your situation.