Ask a room of IT professionals how to make a strong password and most will recite the same recipe: uppercase, lowercase, a digit, a symbol, change it every 90 days, never write it down. Now ask them to actually create one under that pressure. What comes out is almost always the same shape — a season, a year, an exclamation mark. Summer2024! is not a strong password. It is what the recipe produces when a human being follows it honestly.
That gap between the rule and the result is the heart of CISSP — Certified Information Systems Security Professional, and specifically its Identity and Access Management domain. The exam does not test whether you can memorise the recipe. It tests whether you understand why the recipe was abandoned, what replaced it, and how to defend the replacement to a manager who still believes a written-down password is a sin.
What actually happened when the complexity rule met real users
Picture a mid-sized company rolling out a new password policy in early 2025. Eight characters minimum, all four character classes, rotation every 90 days, no reuse of the last five. On paper, textbook security. Six months later the helpdesk is drowning in resets, and the passwords in the wild look like this: More on the topic: “Web Security (OWASP Top 10): How SQL Injections Break Businesses and What Real Practice Teaches”.
Qwerty2025!Company2025!Winter2025!Password1!
Every one of them technically satisfies the policy. Every one of them falls in the first minutes of a dictionary attack with a rule-based mangler, because the mangler was built precisely to try capitalised words followed by a year and a symbol. The policy did not make passwords unpredictable. It made them predictable in a new, uniform way.
The deeper problem is arithmetic. An eight-character password drawn from a full 94-character keyboard looks like it has enormous entropy on paper. In practice, users do not draw randomly from 94 characters — they draw from a vocabulary of maybe a few thousand words plus a handful of transformations. The effective search space collapses from astronomical to something a consumer GPU chews through.
The model that replaced it: length, screening, and slow hashing
NIST Special Publication 800-63B, the digital identity guidelines that most modern identity systems now reference, made a quiet but radical shift. It dropped mandatory composition rules and periodic forced rotation for memorised secrets. In their place, three ideas: More on the topic: “Digital Literacy & Online Safety: Password Manager vs Written Passwords — How to Store Passwords Safely and Build Password Security Habits That Survive Real Life”.
- Length-based entropy. A passphrase of four to six randomly chosen words beats a short "complex" string by orders of magnitude against brute force, because the search space is the dictionary raised to the power of the word count — not the character count.
- Breach-list screening. When a user sets or changes a password, the system checks the candidate against known-leaked corpora — Have I Been Pwned being the most widely used public source — and refuses anything that has already appeared in a breach.
- Rate-limited, slow hashing. Passwords are stored with adaptive algorithms such as bcrypt or Argon2 with a tuned cost factor, so that even a stolen database is expensive to attack offline.
Notice what all three have in common: none of them depend on the user being disciplined. They are controls the system enforces. That is the shift the CISSP mindset rewards — from blaming the human to designing the system so the human's natural behaviour is safe.
Passphrase vs password, in numbers you can check yourself
Take a diceware approach: six words chosen uniformly from a list of 7,776 words. The number of combinations is 7,776 to the sixth power, which is roughly 1.8 × 10²³. Even at a billion guesses per second against a fast hash, that is on the order of millions of years. Now take an eight-character password with the four-class rule. If a user picks a dictionary word, capitalises it, appends a year and a symbol, the real entropy is closer to the entropy of the base word plus a few bits — often under 30 bits, which a determined attacker exhausts in hours.
The passphrase is also easier to type and remember, which matters more than people admit: a control nobody follows is not a control.
Where the "never write it down" advice breaks
Here is a scenario that plays out constantly. A security-aware employee follows every rule, memorises a different complex password for twenty services, and eventually reuses three of them because memory has limits. The person who writes a passphrase on a sticky note inside a locked drawer and uses a password manager for everything else is, in most realistic threat models, safer. More on the topic: “AI Security (Guardrails): How to Protect AI Systems from Hacking — Prompt Injection, Jailbreaks, and Red-Teaming in Practice”.
The threat you are defending against is not a burglar reading your desk. It is credential stuffing — automated replay of leaked username/password pairs across services — and phishing. Neither cares about your sticky note. Both care enormously about whether you reused a password and whether you have phishing-resistant multi-factor authentication.
This is the part that surprises people new to the domain: the single highest-leverage control for stopping credential theft is not the password at all. It is phishing-resistant MFA — hardware security keys or passkeys bound to the origin, which simply cannot be relayed to an attacker's lookalike site the way an SMS code or a push notification can.
The walkthrough: auditing a policy that looks fine
Imagine you are handed the job of reviewing the password policy above. Here is the order a practitioner actually works in, and what breaks at each step if you skip it.
Step one — read the policy against the standard. Does it still mandate composition rules and 90-day rotation? If so, it is out of step with NIST SP 800-63B and is actively generating predictable passwords.
Step two — check the storage. Are passwords hashed with bcrypt or Argon2, or with something fast like a plain SHA-256? If the latter, no amount of password length saves you once the database leaks, because the attacker's guess rate is not throttled.
Step three — check the screening. Does the system reject passwords that appear in breach lists at the moment of setting? This single control catches most of the Summer2024! family before it ever reaches production.
Step four — check the MFA. Is it phishing-resistant, or is it an SMS code that a SIM-swap or a real-time proxy defeats? This is where the biggest risk reduction lives, and it is usually where the least attention has gone.
Skip step two and you have built a beautiful policy on top of a database that hands attackers a free offline cracking session. Skip step four and you have hardened the front door while leaving the window open.
Learning this properly, and the trade-offs of each path
You can pick up the mechanics of passphrases and password managers from a good blog post. What is harder to get on your own is the judgement: knowing which control to prioritise when a manager asks for "the most secure option" and you have to weigh usability, cost, and the actual threat model. That judgement is what the CISSP domains are really training. More on the topic: “Cybersecurity Course: What to Know Before You Start — Requirements, Pitfalls, and the Ethical Line Nobody Explains”.
Self-study is cheap and flexible, but it has a specific failure mode: you read a policy template, nod, and never discover that your version would fail an audit because nobody checked your reasoning. Practice questions help, but only if someone — or something — tells you why your answer was wrong, not just that it was.
A structured course closes that gap by giving you feedback on your decisions. The AI-adapted format on asibiont.com personalises the path to your existing experience, so someone with a networking background does not sit through the basics of access control they already know, while someone coming from a helpdesk gets the depth they need on architecture. It is one route among several — self-study plus a study group, or a formal instructor-led class, are equally valid depending on your budget and how much external structure you need. More on the topic: “Cryptography in Practice: What a Developer Needs to Know About Encryption, PKI, and TLS 1.3 — A Deep Dive into Pitfalls”.
Who this path suits, and who it does not
The CISSP material rewards people who already have some security or IT operations experience, because the domains assume you have seen a real incident, a real audit, or a real policy fight. If you are completely new to the field, the concepts will feel abstract — you would do better building hands-on experience first and returning to this later.
If you are a manager, auditor, or architect who needs to reason about identity and access as a system rather than as a set of rules to recite, it fits well. If you want to be the person who writes exploits, a different path will serve you better.
What to take away
The recipe you were taught — mix the character classes, rotate every 90 days, never write it down — was a proxy that stopped working the moment attackers learned to model human behaviour. What replaced it is simpler and stronger: long passphrases, breach-list screening, slow hashing, and phishing-resistant MFA. The real skill is not memorising the new rules; it is understanding why they work and being able to defend that reasoning in a room full of people who still believe the old ones.
That reasoning is exactly what the CISSP domains train, and the course walks through these decisions with worked examples and gives you feedback on your answers rather than leaving you to guess. If you want to build that judgement properly, the details and enrolment are on the CISSP — Certified Information Systems Security Professional page. More on the topic: “Profession: Cybersecurity Specialist — The Complete Path Into Information Security, Where It Breaks, and How to Avoid Mistakes”.
More on the topic: “The Reliable Password Myth: Why a Capital Letter and a Digit at the End Don't Save You — Leak Checks Do”. More on the topic: “A "Reliable Password" With 8 Characters, a Digit and a Capital Letter: Why That Rule Is an Outdated Myth — and How to Actually Protect Your Accounts”.