Also, I'm watching updated security training, and these f***ers are seriously suggesting that we use 25+ character unique passphrases for our different accounts that we change at least once every three months.
GTFO of here with that. I barely remember my wife's birthday and my social security number, and you want me to have five or six seperate catchphrases changed four times a year each?
Standard practice in the IT world these days. Particularly if you have a lot of access to very sensitive information, which I know you do.
90 days is the standard time on password changes, also. This is all pretty standard stuff.
Our company requires 14+ character passwords, with a combination of 3 letters, numbers, caps, symbols, etc., and a change every 90 days that is automatically enforced. And these are people who really don't have access to anything sensitive, outside of the intellectual property of our company. No access to personal banking info, ss numbers, etc.
The "bad guys" are getting smarter and smarter, and better and better at what they do. One crypto event/infection could bankrupt an entire company. It has. Lots of them.