Password Policies Explained
Key Concepts
- Password Complexity
- Password Expiration
- Account Lockout
- Password History
Password Complexity
Password complexity refers to the rules that dictate the structure and strength of a password. These rules often include requirements for the use of uppercase letters, lowercase letters, numbers, and special characters. The goal is to make passwords harder to guess or crack through brute force attacks.
Example: A policy might require a password to be at least 12 characters long and include at least one uppercase letter, one lowercase letter, one number, and one special character. Such a password might look like "P@ssw0rd!23".
Password Expiration
Password expiration policies mandate that users must change their passwords after a certain period. This is to mitigate the risk of long-term use of a compromised password. The expiration period is typically set by the organization based on its security requirements.
Example: A company might set a policy where passwords expire every 90 days. After 90 days, users will be prompted to create a new password to ensure ongoing security.
Account Lockout
Account lockout policies are designed to protect against brute force attacks by temporarily disabling an account after a specified number of failed login attempts. This prevents attackers from continuously guessing passwords.
Example: An account lockout policy might specify that after 5 failed login attempts, the account will be locked for 30 minutes. This gives users time to realize and report any unauthorized access attempts.
Password History
Password history policies prevent users from reusing old passwords by keeping a record of previously used passwords. This ensures that users create new and unique passwords each time they are required to change their password.
Example: A policy might restrict the reuse of any of the last 10 passwords. If a user tries to set a password that matches any of the last 10, the system will reject it and prompt the user to choose a different one.