What are the rules for passwords in your organisation? 

A decade ago, we were recommending complex passwords with regular updates, but this was poorly enforced and many of us were using repeatable core words with just some details changed. Who else used Summer16! then updated it to Summer17! 

We then guided clients to use pass phrases and longer passwords. The current advised length is 14 characters, so if you are still using passwords with only 8 characters, then it’s definitely time to update. 

Into the 2020s we were recommending MFA (multi-factor authentication) as an additional layer because passwords can be compromised. Now fingerprint and face recognition has become more commonly used as passwordless authentication and passkeys came to prominence. 

It Won’t Happen to Me 

The cost of cybercrime for Australian businesses has increased, with no-one immune. The latest figures are due in October, but for FY25 the average cost per incident was substantial: 

• small business: $56,600 (up 14%) 
• medium business: $97,200 (up 55%) 
• large business: $202,700 (up 219%) 

In 2024-2025, 42% of industry, government and critical infrastructure sector incidents reported to the Australian Signals Directorate involved compromised accounts or credentials. This means that passwords alone are no longer enough to protect your personal and business information. 

If you’re not enforcing strong access control, now is the time to start. Passwords alone won’t cut it. Implement authenticator apps, security keys and passkeys, and make sure your staff understand why.  

Information security, cybersecurity and privacy management system standard ISO27001 can be useful for drawing a line in the sand with compliance in your business. It requires adherence to strong security controls, including staff awareness. Business leaders, if you need an incentive to raise your security standards, an audit might just be it!