Three myths about password policies

It is rarely the thing that gets a project approved, and often the thing that decides how it goes. A few things about password policies that get repeated more often than they get checked.

The cheapest security work is the boring kind done on a schedule. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

“It only matters for big sites”

Length beats complexity rules. Getting it slightly wrong is survivable. Ignoring it entirely is not. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

“We can deal with it after launch”

Sometimes true, usually expensive. None of that requires a large budget, only a decision and someone to own it.

“Our platform handles it”

Check credentials against known breach lists. That sounds obvious written down. It is still the thing most often skipped. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

In practice

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about password policies before you move on:

• Someone can say what the current setup is without going to look
• Forced rotation makes passwords worse, not better — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.