Network Security Passwords and Policies

Passwords are the most widely used authentication method on the planet, and they are also one of the weakest links in network security. Weak passwords, reused passwords, and improperly stored passwords create entry points that attackers exploit every day. Password policies set the minimum standards every user must follow to keep accounts secure.

What Makes a Password Strong

Password strength comes down to how long it would take an attacker's software to guess it. Modern computers test billions of password combinations per second. Length and unpredictability are the two most important factors.

Password Cracking Time Estimates (modern hardware):
┌──────────────────────┬────────────────┐
│ Password             │ Time to Crack  │
├──────────────────────┼────────────────┤
│ cat                  │ Instant        │
│ cat7                 │ Instant        │
│ C@t7!                │ Seconds        │
│ Tr0ub4dor&3          │ Days           │
│ correct-horse-staple │ Centuries      │
│ M$9kL#vQ2!pXr7@      │ Millions of yrs│
└──────────────────────┴────────────────┘

Notice that a random-looking short password (C@t7!) is cracked in seconds, while a longer passphrase (correct-horse-staple) takes centuries. Length beats complexity.

The Anatomy of a Good Password Policy

A password policy is a written set of rules that defines how users and systems must create, store, and manage passwords. Every organization should have one.

Minimum Length

Require at least 12 characters. Longer is better. The NIST (National Institute of Standards and Technology) recommends allowing passwords up to 64 characters to encourage passphrases.

Complexity Requirements

Requiring uppercase letters, lowercase letters, numbers, and special characters has traditionally been considered good practice. However, NIST's latest guidelines suggest that length matters more than complexity. Forcing complex rules often leads users to pick predictable patterns like "P@ssw0rd1!" which are well-known to attackers.

No Reuse

Systems should remember the last 10–24 previous passwords and reject any attempt to reuse them. Reuse defeats the point of changing passwords after a breach.

No Expiration Without Cause

Older policies forced passwords to expire every 30 or 90 days. NIST no longer recommends routine expiration because users who must change passwords frequently pick weaker ones ("January2024!", "February2024!"). Change passwords when there is evidence of compromise, not on a calendar schedule.

Prohibition of Common Passwords

Block the most commonly used passwords. Any system that allows "password", "123456", or "qwerty" is wide open to dictionary attacks. Maintain a blocklist of millions of known compromised passwords and reject them on creation.

How Systems Store Passwords

Storing passwords in plain text is a critical security failure. Any database breach immediately exposes every user's password. Proper storage uses cryptographic hashing.

WRONG (plain text):
  Database: username="alice" password="MyDogRex2023!"

RIGHT (hashed + salted):
  Database: username="alice" hash="$2b$12$Kd8...randomhash..."

Even if attackers steal the database, they get hashes, not passwords.

What Is a Salt

A salt is a random value added to a password before hashing. Two users with the same password get different hashes because each has a unique salt. This prevents attackers from using precomputed hash databases (rainbow tables) to reverse hashes quickly.

Alice's password: "sunshine"
Salt: "xK7q"
Combined: "xK7qsunshine"
Hash: a3b1c9... (unique to Alice)

Bob's password:  "sunshine"  ← same password
Salt: "mP2r"
Combined: "mP2rsunshine"
Hash: f7e4a2... (completely different hash!)

Password Managers — The Practical Solution

Humans cannot reliably remember 50 different strong, unique passwords for every service they use. Password managers solve this by storing all passwords in an encrypted vault, protected by one strong master password and MFA.

WITHOUT a password manager:
  Bank:     sunshine2020
  Email:    sunshine2020  ← reused
  Work:     sunshine2020  ← reused

WITH a password manager:
  Bank:     x#Kp9!mQv7Lr&N2j  ← unique, 16 chars
  Email:    Tr8@vFw!2nYsK7Pd  ← unique, 16 chars
  Work:     Qm5!bXz9Rv#4HkWn  ← unique, 16 chars

Privileged Account Password Controls

Administrator accounts and service accounts need stricter password controls because they have elevated access.

Control                           | Standard User | Admin Account
----------------------------------|---------------|---------------
Minimum password length           | 12 chars      | 20+ chars
MFA required                      | Recommended   | Mandatory
Password change on any compromise | Yes           | Immediate
Shared accounts allowed           | No            | Never
Account monitored for anomalies   | Yes           | Intensive

Common Password Mistakes Users Make

Mistake                          | What Attackers Do With It
---------------------------------|------------------------------------------
Using pet names, birthdays       | Guess from social media
Adding "!" at the end            | All dictionary attacks include this
Replacing o with 0, a with @     | Pre-built into attack rules
Using same base + different year | "Company2023" → try "Company2024"
Writing password on sticky note  | Physical access = instant compromise
Using work email for personal    | One breach exposes both accounts

Password policies only work when they are enforced technically, not just written in a handbook. Systems should automatically reject weak passwords, automatically lock accounts after failed attempts, and automatically alert security teams when login patterns look unusual. Policy without enforcement is a wishlist.