Password Security Playbook

Password Security Playbook: Your essential guide to creating, managing, and protecting strong passwords to safeguard sensitive data and prevent security breaches.

1. Password Creation Guidelines End Users:

• Use Strong Passwords: Create passwords with a mix of uppercase, lowercase, numbers, and special characters (e.g., @, #, $) Example: StrongP@ssw0rd
• Minimum Length: Passwords should be at least 12 characters long
• Avoid Common Words: Don’t use easily guessable passwords like names, birthdates, or dictionary words
• Passphrases: Consider using a memorable sentence or phrase. For example: IlovetoplayTennis!
• Unique Passwords: Avoid reusing passwords across different accounts, especially for sensitive systems

2. Multi-Factor Authentication (MFA) End Users:

• Enable MFA: Always use multi-factor authentication (MFA) when available to add an extra layer of security
• Types of MFA: Common MFA options include:
  • One-time passwords (OTP) via email/SMS
  • Authenticator apps (Google Authenticator, Microsoft Authenticator)
  • Hardware tokens like YubiKey

Cybersecurity team:

• Mandate MFA: Ensure that all critical systems require multi-factor authentication, particularly for admin and executive-level accounts
• Risk-Based Authentication: Consider implementing risk-based MFA, where higher-risk actions (e.g., financial transactions) trigger additional authentication

3. Password Storage and Sharing End Users:

• No Sharing: Never share your passwords with others, even with IT or supervisors
• Secure Storage: If you must write down a password, store it in a secure place, such as a password manager or encrypted file
• Avoid Storing in Browsers: Don’t save passwords directly in browsers unless the device is secured and monitored by IT

Cybersecurity team:

• Password Sharing Policy: Establish clear policies that prohibit password sharing within teams and across departments
• Use Delegation Tools: For shared access or service accounts, use delegation tools (e.g., access control features) instead of sharing credentials

4. Password Expiry and Reset Protocols [Content continues with sections 5-10, including Account Lockout, Password Audits, Password Manager Usage, Director-Level Responsibilities, Training and Awareness, and Review and Update Policy]