Password policy

A password policy is the set of rules an organization applies to its account passwords: minimum length, composition, lifetime, rejection of known-compromised passwords, lockout after a run of failed attempts. The doctrine flipped in 2017. The NIST (National Institute of Standards and Technology) Special Publication SP 800-63B stopped recommending forced periodic changes and composition rules (one uppercase letter, one digit, one symbol), which produced Spring2024! followed by Summer2024!. Instead it calls for adequate length and for checking every new password against a list of known-breached ones. Its next revision prohibits requiring periodic changes absent evidence of compromise. The password on Colonial Pipeline's VPN account in May 2021 had, according to Mandiant, turned up in a batch of leaked passwords. The cyber questionnaire seldom asks about the policy itself. It assumes the password will leak, through phishing, an infostealer or credential stuffing, and asks what happens next: MFA (multi-factor authentication), lockout, sign-in monitoring. When it does come back to passwords, it is on specific points: minimum length for privileged accounts, default passwords on equipment, a password manager for the IT team, unique local admin passwords. Those answers are hard to verify from outside. The underwriter cross-checks against known leaks, and employee credentials found in recent infostealer logs contradict a "compliant policy" better than any interview. A practitioner's caveat: an Active Directory policy that looks flawless on paper often leaves untouched the service accounts created before it, with a password that never expires and that nobody dares to change.