While it is an accepted fact of security that any password can be guessed given sufficient resources, every organization should attempt to maintain strong passwords to deter and delay such compromises. The following measures can be taken to help in this process:
1. Passwords should be sufficiently complex:
a. Be at least eight characters in length
b. Contain upper case, lower case, and special characters
c. Not be a word in any language or found in any dictionary
d. Not bear any resemblence to the user, family, pets, etc.
2. Enforce password history. Ensure users must pick a new unique password and can not re-use old passwords.
3. Maximum password age. After a set amount of time (recommended 30 - 90 days), the password should expire and force users to select a new one.
4. Test password security by attempting to "crack" passwords. Only do so with written permission from a CEO/CSO/CxO.
5. Ensure users are educated on password security and the importance of passwords. This includes training on what not to do regarding passwords (ie: share them, write them down).