Password Policies and Multi-Factor Authentication

Passwords remain the most common authentication mechanism despite being the most frequently compromised. Attackers steal passwords through phishing, credential stuffing (reusing breached credentials), brute-force attacks, and keyloggers. Even a 'strong' password provides limited protection if an attacker can silently capture it. Password policies set minimum requirements for complexity and rotation to reduce risk, but the most impactful security improvement is adding a second factor — because knowing the password is no longer sufficient to gain access.

Effective password complexity policies define minimum standards that make passwords harder to crack. Traditional requirements include: minimum length (12-16 characters minimum; length matters more than complexity), required character types (uppercase, lowercase, numbers, symbols), prohibition of common passwords (password dictionaries), and prohibition of the username or organization name within the password. NIST SP 800-63B guidelines updated in 2017 recommend prioritizing length over arbitrary complexity rules and checking passwords against breached credential databases rather than requiring frequent rotation.