Password policies and best practices in Cybersecurity - Mini Project: Build & Apply

Password Policies and Best Practices

📖 Scenario: You are working in a company that wants to improve its security by setting clear password rules for all employees. Your task is to create a simple guide that lists the password policies and best practices everyone should follow.

🎯 Goal: Build a clear, easy-to-understand list of password policies and best practices that can be shared with all employees to help them create strong and secure passwords.

📋 What You'll Learn

Create a list of common password policy rules

Add a variable to set the minimum password length

List best practices for creating strong passwords

Include a final summary statement emphasizing password security

💡 Why This Matters

🌍 Real World

Companies and individuals use password policies to protect sensitive information and prevent unauthorized access.

💼 Career

Understanding password policies is essential for roles in IT security, system administration, and any job that involves protecting digital accounts.

1

Create a list of password policy rules

Create a list called password_policies with these exact rules as strings: 'Passwords must be at least 8 characters long', 'Passwords must include uppercase and lowercase letters', 'Passwords must contain numbers', 'Passwords must have special characters'.

Cybersecurity

# Create the list password_policies with the exact rules
# Your code here

Hint

Use a Python list with the exact strings inside quotes and separated by commas.

2

Set the minimum password length

Create a variable called min_length and set it to the number 8 to represent the minimum password length.

Cybersecurity

password_policies = [
    'Passwords must be at least 8 characters long',
    'Passwords must include uppercase and lowercase letters',
    'Passwords must contain numbers',
    'Passwords must have special characters'
]
# Create the variable min_length and set it to 8
# Your code here

Hint

Just assign the number 8 to the variable min_length.

3

List best practices for strong passwords

Create a list called best_practices with these exact entries as strings: 'Use a mix of letters, numbers, and symbols', 'Avoid common words or easy patterns', 'Do not reuse passwords across sites', 'Change passwords regularly'.

Cybersecurity

password_policies = [
    'Passwords must be at least 8 characters long',
    'Passwords must include uppercase and lowercase letters',
    'Passwords must contain numbers',
    'Passwords must have special characters'
]

min_length = 8
# Create the list best_practices with the exact entries
# Your code here

Hint

Use a list with the exact strings as shown, separated by commas.

4

Add a final summary statement

Create a string variable called summary with this exact text: 'Strong passwords protect your accounts and personal information.'

Cybersecurity

password_policies = [
    'Passwords must be at least 8 characters long',
    'Passwords must include uppercase and lowercase letters',
    'Passwords must contain numbers',
    'Passwords must have special characters'
]

min_length = 8

best_practices = [
    'Use a mix of letters, numbers, and symbols',
    'Avoid common words or easy patterns',
    'Do not reuse passwords across sites',
    'Change passwords regularly'
]
# Create the summary string with the exact text
# Your code here

Hint

Assign the exact sentence as a string to the variable summary.

Practice

1. Which of the following is a key characteristic of a strong password?

easy

A. It is a common word found in the dictionary.

B. It contains a mix of letters, numbers, and special characters.

C. It uses only your birthdate for easy recall.

D. It is shorter than 6 characters.

Solution

1. Step 1: Understand password strength criteria

   A strong password should mix letters, numbers, and special characters to increase complexity.

2. Step 2: Evaluate each option

   Options A, B, and D describe weak passwords that are easy to guess or too short.

3. Final Answer:

   It contains a mix of letters, numbers, and special characters. -> Option B

4. Quick Check:

   Strong password = mix of characters [OK]

Hint: Strong passwords mix letters, numbers, and symbols [OK]

Common Mistakes:

• Choosing simple or common words
• Using only numbers or letters
• Making passwords too short

2. Which password policy rule is correctly written?

easy

A. Passwords must be at least 8 characters long.

B. Passwords should be exactly 4 characters.

C. Passwords must contain only letters.

D. Passwords should never include numbers.

Solution

1. Step 1: Recall standard password length rules

   Most secure policies require passwords to be at least 8 characters for safety.

2. Step 2: Check each option against best practices

   Options A, C, and D contradict common security advice by limiting length or character types.

3. Final Answer:

   Passwords must be at least 8 characters long. -> Option A

4. Quick Check:

   Minimum length = 8 characters [OK]

Hint: Minimum password length is usually 8 or more [OK]

Common Mistakes:

• Setting passwords too short
• Restricting characters unnecessarily
• Ignoring numbers or symbols

3. Consider this password policy code snippet in Python:

def is_strong(password):
    return (len(password) >= 8 and
            any(c.isdigit() for c in password) and
            any(c.isalpha() for c in password) and
            any(not c.isalnum() for c in password))

print(is_strong("Pass123!"))
print(is_strong("password"))

What will be the output?

medium

A. True
False

B. False
True

C. True
True

D. False
False

Solution

1. Step 1: Analyze the first password "Pass123!"

   It has length 8, digits (1,2,3), letters (P,a,s,s), and special character (!), so returns True.

2. Step 2: Analyze the second password "password"

   It has letters only, no digits or special characters, so returns False.

3. Final Answer:

   True False -> Option A

4. Quick Check:

   Strong password check = True, weak password check = False [OK]

Hint: Check digits, letters, special chars for True [OK]

Common Mistakes:

• Ignoring special character check
• Assuming letters-only is strong
• Misreading length condition

4. A company enforces this password rule: "Passwords must include at least one uppercase letter, one lowercase letter, and one number." Which password violates this rule?

medium

A. Secure1

B. Secure123

C. secure123

D. S3curePass

Solution

1. Step 1: Check each password for uppercase, lowercase, and number

   secure123 has no uppercase letters, violating the rule.

2. Step 2: Confirm other options meet all criteria

   Options B, C, and D all have uppercase, lowercase, and numbers.

3. Final Answer:

   secure123 -> Option C

4. Quick Check:

   Missing uppercase letter = violating rule [OK]

Hint: Look for missing uppercase, lowercase, or digits [OK]

Common Mistakes:

• Overlooking missing uppercase letters
• Assuming numbers alone are enough
• Ignoring case sensitivity

5. An organization wants to improve account security by combining password policies with two-factor authentication (2FA). Which of the following best describes this approach?

hard

A. Using strong passwords alone is enough for security.

B. Using simple passwords with 2FA is the safest method.

C. 2FA replaces the need for strong passwords entirely.

D. Combining strong passwords with 2FA adds an extra security layer.

Solution

1. Step 1: Understand the role of strong passwords and 2FA

   Strong passwords protect against guessing, while 2FA adds a second verification step.

2. Step 2: Evaluate each option's security approach

   Combining strong passwords with 2FA adds an extra security layer, which correctly states that both improve security. Options A, B, and C misunderstand or weaken security.

3. Final Answer:

   Combining strong passwords with 2FA adds an extra security layer. -> Option D

4. Quick Check:

   Password + 2FA = stronger security [OK]

Hint: Strong password + 2FA = best protection [OK]

Common Mistakes:

• Thinking 2FA replaces passwords
• Relying on weak passwords with 2FA
• Ignoring multi-layer security benefits