Looking at adding some program tracking to Salesforce, and the data from the program will be subject to security requirements put forth by our state's Chief Information Officer. There are a few requirements around passwords that I'm not sure can be enforced in Salesforce:
- Not contain the user's name, UserID or any form of their full name
- Not consist of a single complete dictionary word, but can include a passphrase
- Be significantly different from the previous four passwords. Passwords that increment (Password1, Password2, Password3 ...) are not considered significantly different
Is there an app or a hack for accomplishing any of those? Or do any of them become options via Salesforce Shield?
Salesforce doesn't offer more complexity than can be configured on the Password Policies setting for each profile.
Because the password is not stored in Salesforce (as is standard best practice), there is no technical way to add a custom complexity check between setting a new password and it being registered in Salesforce. So there can't be a third-party app that sits between the password reset page and the user's record.
Our strongest recommendation is to use a Single Sign On (SSO) system, and you can then choose from many competing 3rd-party products that do allow configuring more password complexity. Microsoft Entra SSO is popular, as is Okta (which Salesforce uses for internal user access). You should seriously consider using such an SSO provider to capture and enforce your password policies, thus bypassing the need to use Salesforce login with password.
MFA is also a strong requirement for any SSO implementation - the best SSO systems provide robust MFA capabilities.
