Guide · Data security
Regular changes, special characters, complexity rules: which password requirements do more harm than good by today's standards – and what matters instead.
For decades the rule was: passwords must be changed every 90 days and contain upper- and lower-case letters, digits and special characters. Both rules are now considered outdated – the BSI (German Federal Office for Information Security) dropped its recommendation for regular changes years ago.
The reason is observed behaviour. People who have to change their password every three months do not come up with a new one; they add a digit. Summer2024! becomes Summer2025!. For an attacker who knows an old password, that is no obstacle. And because nobody can remember four different complex passwords a year, they end up on notes under the keyboard.
So passwords are now only changed for a reason: if there is a suspicion that a third party has learned them, after a data breach has become known, and when people who knew the password leave.
What applies instead
Four rules that actually make a difference – and that people can stick to in everyday work.
Tool
The most common concern is: if everything is in one place, isn't that particularly dangerous? The answer: the alternative is more dangerous.
The alternative is not secure passwords kept in people's heads, but the same three passwords everywhere, notes in desk drawers and lists in Excel files on the network drive. A password manager replaces exactly that.
Some credentials belong to the business, not to a person: banking portals, government accounts, vendor portals. A password manager with team features shares them selectively and logs who has used them.
The vault should be encrypted in such a way that even the provider cannot see inside. An emergency arrangement is also important: what happens if the only person with the master password is unavailable?
Every business has credentials that several people use. They are the area with the greatest risk and the least attention.
Frequently asked questions
In most cases yes, but not on its own. What makes sense is the combination: remove the forced change, and in return increase the minimum length, introduce two-factor authentication and provide a password manager.
If you only switch off the forced change and change nothing else, you make things worse. Also check whether requirements from your customers or from a certification stand in the way – some audit catalogues still lag behind the recommendation.
Change the affected password and check all other services where the same or a similar one was used. This is exactly why the rule “a separate password for every service” is so important – it limits the damage to one service.
Also check whether forwarding rules or other rules have been set up in the affected account, and revoke active sessions.
They are currently the most promising route. A passkey is bound to a device and cannot be captured through a fake login page – which removes the most common method of attack.
The catch is adoption: not every line-of-business application supports them, and the question of what happens if a device is lost must be settled beforehand. For the major services, it is already worth getting started today.
It is the only password anyone has to remember – so it can be long. Four to five unrelated words are a good benchmark.
The emergency arrangement is important: a master password that only one person knows is a business continuity risk. Deposit it sealed in a secure place.
Dipl.-Ing. Mohamed Khater
Dipl.-Ing. Mohamed Khater founded INFONET Computer GmbH in Cologne in 1992. When we take over an IT environment, we regularly find password lists in spreadsheets on open network drives – usually created because nobody provided a better solution.
Free security check
We look at which credentials exist, how they are secured and where factory settings are still active. In our experience, the appointment with the most surprises.
+49 221 984300-0Switchboard and support hotline
[email protected]Reply within 4 hours on working days
Robert-Perthel-Straße 7250739 Köln – Bilderstöckchen
Mon–Fri 9 am–6 pmEmergency support outside these hours by arrangement
This website works without cookies, without tracking and without advertising networks. For one optional feature we embed content from an external provider. Doing so transfers your IP address to that provider – which only happens if you allow it.
