The Weak Password Policy
A small business has a password policy that requires employees to change their passwords every 30 days. The policy also requires passwords to be at least 8 characters long and include a mix of uppercase, lowercase, numbers, and symbols. However, many employees struggle to remember complex passwords and resort to writing them on sticky notes or using predictable patterns like 'Password123!' or 'CompanyName2024!'. The IT manager notices that several accounts have been compromised recently, with attackers gaining access through credential stuffing (using leaked passwords from other breaches). The business uses a cloud-based email service and a shared file server. The IT manager is considering implementing a new policy but is unsure what changes to make.
1. What are the weaknesses in the current password policy, and how might they contribute to the compromises?
Read the worked answer
- Frequent forced changes (every 30 days): This encourages users to choose weak, predictable passwords or reuse patterns (e.g., adding a number each time). It also leads to poor storage practices like sticky notes.
- Minimum length of 8 characters: While 8 is a common minimum, it is no longer considered strong; longer passphrases are better. Complexity requirements often lead to predictable substitutions (e.g., 'P@ssw0rd').
- Lack of breach detection: The policy doesn't check against known breached passwords, so users may choose passwords that are already in attacker dictionaries.
- No account lockout or rate limiting: Credential stuffing attacks rely on trying many passwords; without lockout, attackers can keep trying.
- No multi-factor authentication (MFA): MFA would prevent unauthorized access even if passwords are compromised.
- Password reuse: Employees may reuse passwords across personal and work accounts, so a breach elsewhere can compromise work accounts.
2. Recommend a revised password policy and additional measures to improve security. Justify your recommendations.
Read the worked answer
- Increase minimum length to 12-16 characters and encourage passphrases (e.g., four random words). Length is more important than complexity for resisting brute force.
- Remove periodic forced changes unless there is evidence of compromise. Frequent changes lead to weaker passwords. Instead, force change only on suspicion of breach.
- Implement a breached password check: Use a service like Have I Been Pwned to block passwords known to be compromised.
- Enforce MFA for all users, especially for email and remote access. This adds a critical layer beyond passwords.
- Implement account lockout after a few failed attempts and rate limiting to thwart credential stuffing.
- Provide a password manager to help users generate and store strong, unique passwords.
- Educate users on phishing and password hygiene.
- Monitor for suspicious activity such as login attempts from unusual locations.