Are Password Updates Really Necessary?

One of the biggest cybersecurity tips you typically hear is “update your passwords regularly.” But let’s be honest – most people don’t listen to this advice and even if you do (or are forced to), each time you wonder if it’s really that important.

In previous years, passwords updates were the standard security measure. It was meant to keep your accounts secure and regularly remove access to accounts for anyone that shouldn’t have it. But as technology has advanced, so has cybersecurity. And with it, best practices may have shifted as well.

As part of Cybersecurity Awareness Month, let’s dive into why there was such an emphasis put on updating passwords, what the best recommendations are now, and tips for creating strong passwords.

Why Were Frequent Password Updates the Recommendation?

Previously, most companies, organizations, and even accounts required a password change periodically.  The main purpose of these frequent updates was to limit how long logged in devices could keep access to accounts – meaning it would limit the amount of time a stolen password could be used.

When cybercrimes – and criminals – weren’t as sophisticated as they are now, this made sense. Using a password used to be that the main way for a hacker to gain access to information. So, if you repeatedly updated yours, it made it harder to crack your accounts.

But despite these good intentions, requiring frequent password updates also came with some downsides.

Most people did the bare minimum to actually update their password – usually having a predictable sequence that they added to or slightly altered that could still be easily guessed. Along with this, there are problems with constant password changes, such as:

• Reusing old passwords
• Storing them somewhere that isn’t secure
• Choosing weaker, but easier to remember passwords
• Increased frustration

As technology and cybersecurity has evolved, so have password recommendations.

How Often Should You Change Your Password?

There isn’t one universal answer to when you should update your password. Instead, it depends on the type of account, organization rules, and if you’ve experienced any security threats.

If you have a strong, unique password you don’t necessarily need to change it just because 30, 60, 90, or however many days have passed. But if any of these situations occur, then you should update your password sooner rather than later:

• Account was compromised
• Password was exposed in a data breach
• You accidentally shared the password
• Someone who previously had access needs to be removed
• You used the same password in another compromised account
• Your company’s security policy requires an update

Ultimately the focus when it comes to passwords is on protection – for both you and your company. Ensuring that you update when needed helps keep everyone safe.

What Makes a Password Secure?

The talk with passwords is always to use something unique and secure. But knowing what “secure” means can be confusing. To help simplify it, remember that passwords should follow three key guidelines:

1. Length: The longer the password doesn’t mean it’s always better. Instead, you want something that’s long enough to not be easily guessed, while being short enough that you can actually remember it. That’s where password phrases come in handy – they add length to your password while still giving you something to remember.
2. Uniqueness: It sounds complicated and annoying, but you really should have a different password for every account. When you reuse the same password repeatedly, you’re exposing all those accounts to the same risks. If one of them is compromised, now they all are because someone could guess that you use the same password across the board – and they would be right.
3. Easy to guess: For every password, you want to avoid using easily guessed information – names, birthdays, company info, personal information (especially that can be readily found online), and sequences.

A Better Approach to Password Security

Because there’s no hard and fast rule of when passwords should be updated and how they should be managed, here are a few tips businesses and individuals can use to help improve their password strength:

• Use long, unique passwords
• Use a reputable password manager
• Enable multi-factor authentication
• Change passwords when accounts are compromised
• Monitor for suspicious login activity
• Remove unnecessary account access
• Learn about phishing schemes
• Review cybersecurity policies and best practices regularly

Doing these things will make you less of a target to cybercriminals, while still making passwords feel manageable.

 When it comes to password updates, there are other factors that matter more than requiring new credentials after a certain amount of time. Focusing on strong, unique passwords, MFA, password management, and good cyberthreat response strategies can keep your information more secure – and reduce the frustrations of required passwords changes.

How We Can Help

Not sure whether your business’s password policies are keeping your systems secure? Our IT team can help you identify vulnerabilities, strengthen access controls, and build a cybersecurity strategy that protects your business. Send us a message to schedule a free consult, and let’s get to work reinforcing your systems!