Enterprise Password Management

Most password policies rest on rules the profession abandoned a decade ago. Mandatory quarterly rotation, complexity requirements and password hints all reduce security while making everyone feel better.

This article covers what works instead.

What is no longer recommended

Mandatory periodic rotation. If someone must choose a new password every 90 days, it becomes Spring2026!, then Summer2026!. The pattern is predictable, and that is exactly what an attacker tries. Rotation is warranted only on suspicion of compromise.

Complexity rules. The "must contain uppercase, a number and a special character" requirement leads to predictable substitution: @ for a, 0 for o. Cracking dictionaries have known these for years.

Security questions. Mother's maiden name and first car are public data. Disable them where possible.

What to do instead

Length over complexity. A 16-character passphrase of several words is orders of magnitude stronger than an 8-character word complicated by substitutions, and far easier to remember.

A banned password list. This is the single most important measure. Include the company name, product names, the city, seasons and common passwords known from public breaches. Most identity providers support this.

Checking against known breaches. If a password appears in a prior breach it must be changed immediately, regardless of complexity.

MFA. The password alone is not enough and never will be. Multi-factor authentication is what stops credential theft.

Password manager: how to roll it out

A password manager is not a convenience tool but a security control: without one users reuse passwords, and a single external breach suffices for entry.

Choose the enterprise edition. Shared entries, group access and logging are why the enterprise licence is needed rather than the personal one.

Start with IT and executives. If those holding the most access use it, most of the risk is covered and you gain internal references.

Provide migration help. Browser-stored passwords can be imported. If that does not work on day one, the rollout fails.

Disable browser storage only after the password manager works. In the reverse order, users write passwords on paper.

Have a recovery process. What happens when someone forgets the master password? Without an answer, the helpdesk disables the whole thing after the first case.

Service accounts: a separate category

Service account passwords carry more risk than human ones. They typically run with passwords unchanged for years, stored in a document, and often with excessive rights.

• Long random passwords: at least 25 characters. At that length offline cracking of a Kerberoasting attack is hopeless.
• Managed accounts where possible (gMSA), where the system handles and rotates the password.
• Privilege restriction: a service account should never hold domain administrator rights.
• Sign-in location restriction: the account should only authenticate from the server where it must run.

Local administrator passwords

If every machine shares the same local admin password, compromising one machine means access to the entire estate. The answer is a unique, automatically rotated password per machine (LAPS in Windows environments), stored by the system and released based on authorisation.

This is one of the cheapest and fastest measures to deploy, yet it is missing from many environments.

What to measure

Four indicators suffice:

• How many accounts lack MFA (target: zero on externally reachable services)
• How many service account passwords are older than a year
• How many machines share a local admin password
• How many users have adopted the password manager

These four numbers come from a few queries, and typically each is worse than you expect. Our IT security services include reviewing the authentication architecture.