Why password policies matters more than it looks

The version of this that works is simpler than the version most people imagine. Password policies is easy to treat as a detail, and that is exactly why it is worth a few minutes of attention.

The realistic threat for most small businesses is automated and opportunistic, not targeted. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

The reason this keeps coming up

Length beats complexity rules. Where this goes wrong is almost never a lack of knowledge. Check it against what you would want a competitor's site to get wrong.

Forced rotation makes passwords worse, not better. The reasoning matters more than the rule, because the rule has exceptions. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

Where it usually goes wrong

Check credentials against known breach lists. The teams that handle this well are rarely the ones with the biggest budgets. If two people in the business would answer this differently, that gap is the actual problem.

How to tell if yours is fine

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about password policies before you move on:

• Someone can say what the current setup is without going to look
• Forced rotation makes passwords worse, not better — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If you are not sure where your systems currently stand on this, it takes us about an hour to find out.