The rules you know produce sticky notes
At least one uppercase letter, one number and one symbol. Mandatory change every three months. Never the same as the last five. These rules are still widespread, and they almost always get the same result: Spring#2025 becomes Summer#2025, then Autumn#2025, and the current version ends up on a scrap of paper stuck to a monitor in the accounts department.
The digital identity guidelines from NIST, the US National Institute of Standards and Technology (publication SP 800-63B, "Digital Identity Guidelines"), are a reference cited well beyond the United States, and on several points they go in the opposite direction. They favour length over complexity, and advise against mandatory composition rules and forced periodic changes without a reason. Instead, they call for a password to be changed when there is evidence that it has been compromised, and for new passwords to be checked against lists of passwords that have already leaked or are too common.
Old rules and today's practice
| Old rule | Today's practice |
|---|---|
| Mandatory uppercase letter, number and symbol | Long passwords, including multi-word phrases, with no imposed composition rules |
| Forced change every few months | Change when there is suspicion or evidence of compromise |
| No checks on the passwords chosen | Checked against lists of leaked or overly common passwords |
| Pasting the password into the login field is blocked | Pasting allowed, so the password manager can do its job |
| Security questions, such as the name of your first pet | Account recovery verified with a second factor |
| Excel sheet with the shared credentials | Shared vault in the password manager, with permissions by department |
| Password as the only protection | Password plus MFA on the logins that matter |
Long beats complicated
A password is hard to guess if it is long and unpredictable, not if it always has a hash sign in the same place. A passphrase, meaning a phrase made up of several unrelated words, is longer than any "complex" password and easier to remember. It is the right choice for the few passwords you need to keep in your head: the one for your computer and the one for your password manager. It does not work if the words are a famous quotation, the company name or the football team you support.
The business password manager, and how to introduce it
Nobody can remember dozens of long, different passwords: without a tool, people reuse them or write them down. A password manager generates them, stores them encrypted and fills them in for you. It also has a useful side effect: it links each password to the right site, and does not offer it on a fake page with a different address.
- Choose a business solution, not each person's own browser extensions: the company must be able to manage users, groups and leavers.
- Protect access to the password manager with a passphrase and MFA: it is the key to all the others.
- Start with the shared credentials: the banking portal used by the accounts department, the courier website used by the warehouse, the supplier portals. They come out of the Excel sheet and go into a shared vault for each department, visible only to those who need it.
- Support your people: a half-hour introduction and someone to ask during the first few weeks are worth more than a company-wide memo.
- Delete the old sheet, along with its copies in email and shared folders, once the migration is complete.
Reuse, service accounts and factory passwords
- Never reuse your work password elsewhere. When an online shop or a forum suffers a breach, attackers try the same email and password pairs on Microsoft 365 and on company VPNs. Your work password is for work only.
- Shared credentials and service accounts. The "warehouse" login used by four people and the account the ERP uses to run its backup have no natural owner, and that is why they stay the same for years. Each one must be assigned to a named owner, stored in the password manager and changed when someone who knows it changes role.
- Default passwords. Printers, routers, cameras and phone systems leave the factory with known credentials, printed in manuals that anyone can download. They must be changed at installation, and checked on devices that have already been on the network for some time.
When someone leaves
On the day a colleague leaves the company, their account is disabled, but the credentials they knew are often overlooked: the department's shared credentials, the service accounts, the supplier portals. With a password manager you know which vaults they had access to, and therefore which passwords to change. The full procedure is in the guide on joiners, role changes and leavers.
A password is only the first layer
Even the best password can be stolen through a fake page or from an infected computer. That is why, on the logins that matter (email, remote access, admin accounts), it should be combined with a second factor: how to choose one and where to start are explained in the guide on multi-factor authentication. And since deception is still one of the commonest ways to steal a password, it is also worth reading up on how to reduce phishing.
In short
The most common rules (mandatory composition and a change every few months) are outdated: what matters today is length, never reusing passwords and changing them only when there is a reason. A business password manager makes all this sustainable and replaces the Excel sheet of shared credentials, while MFA protects you when a password ends up in the wrong hands anyway.