Describe security password policy elements, such as management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics)

Password management and complexity

A password policy is the set of rules an organization enforces about how passwords are created, stored, and changed. Typical elements:

• Length: the single most important factor. Each added character multiplies the brute-force effort. Modern guidance favors long passphrases (for example, 14 or more characters) over short complex strings.
• Complexity: requiring a mix of uppercase, lowercase, digits, and symbols, and forbidding dictionary words, the username, or the company name. Complexity rules defeat pure dictionary attacks but can push users toward predictable patterns like Summer2026!.
• Rotation (expiration): requiring passwords to be changed periodically, for example every 90 days, and preventing reuse of the last several passwords. Current guidance (including from NIST) has moved away from forced frequent rotation, because it encourages weak, incremental passwords; instead, change passwords when there is evidence of compromise. However, you may still see rotation described as a policy element on the exam.
• Lockout: disabling an account for a period after a set number of failed attempts (for example, 5 failures locks the account for 30 minutes). This defeats online brute-force and dictionary attacks.
• No reuse across systems: one leaked password should not open every door.
• Password managers: software that generates and stores a unique, long, random password per site or device, protected by one strong master password (and ideally MFA). Password managers are the practical answer to the “long, unique, complex, and I cannot remember it” problem and are recommended in modern policies.
• Secure storage: systems must store passwords as salted hashes, never in clear text (this is exactly why enable secret beats enable password).

Password alternatives: multifactor authentication

Multifactor authentication (MFA), also called two-factor authentication (2FA) when exactly two factors are used, requires proof from more than one independent category:

• Something you know: a password, PIN, or security question.
• Something you have: a smartphone app generating one-time codes, a hardware token, a smart card, or an SMS code (the weakest “have” factor, because SMS can be intercepted or a phone number ported).
• Something you are: a biometric such as a fingerprint, face, iris, or voice.

Two factors from the same category (a password plus a PIN) are not multifactor; they are two “know” factors. MFA is the most effective single defense against password attacks, because a stolen password alone is useless without the second factor. Cisco Duo is Cisco’s MFA product and appears in Cisco courseware.

Password alternatives: certificates and PKI

A digital certificate is an electronic document that binds an identity (a person, server, or device) to a public key, and is digitally signed by a trusted certificate authority (CA). The system that issues, distributes, and revokes certificates is called a public key infrastructure (PKI).

The underlying idea is asymmetric (public-key) cryptography: each party has a mathematically linked key pair. Anything encrypted with the public key can be decrypted only by the private key, and anything signed with the private key can be verified by anyone holding the public key. A certificate lets you trust a public key because a CA you already trust has vouched for it. Your browser trusts an HTTPS website this way: the site presents a certificate, the browser checks that a trusted CA signed it and that the name matches, and the connection proceeds.

As an authentication alternative, a user or device can prove identity by proving possession of the private key matching its certificate, with no password at all. This is used in EAP-TLS for Wi-Fi (5.9), in IPsec VPNs (5.5), and for smart-card login. Certificates are a “something you have” factor.

Password alternatives: biometrics

Biometrics authenticate by a physical characteristic: fingerprint, facial geometry, iris pattern, retina, voice, or even typing rhythm. Advantages: nothing to forget or write down, hard to share. Disadvantages: a compromised biometric cannot be changed like a password, readers have false accept and false reject rates, and privacy concerns. In practice biometrics are used as one factor in MFA (for example, a badge plus fingerprint for a data center door, or a phone unlocked by face and then generating a one-time code).