Don't Waste Time and Energy Tinkering With Password Policies; Invest in More Robust Authentication Methods or Other Compensating Controls

Summary

Password policies cannot ameliorate the inherent weaknesses of passwords themselves. Security and risk management leaders responsible for IAM should not focus on crafting the perfect policy, and should invest in new authentication methods and other compensating controls in line with business needs.