Improving password policy strategies: a government employee perspective

Purpose The purpose of this study is to explore how government employees perceive and adapt to complex password policies. This study also investigates alternative password policy strategies that are more suitable for different groups of employees, particularly those with limited technical expertise and different levels of authority and responsibility. Design/methodology/approach This research uses a structured questionnaire distributed to 191 government employees, selected purposively to represent diverse authority levels and technical expertise. Based on hypotheses and literature reviews, the instrument includes 33 closed-ended questions (e.g. Likert scale and multiple-choice) covering demographics, password policy perceptions, preferences and usage experiences. Readability testing ensures accessibility for skilled and non-skilled respondents. Data collection is conducted electronically, and the analysis uses statistical techniques, including non-parametric tests, to validate hypotheses. The findings of this study provide actionable recommendations for designing effective, user-friendly password policies and offering evidence-based strategies to enhance security and compliance in government organizations. Findings The survey highlights important behaviors and preferences regarding password policies. Many employees reuse passwords across accounts, posing significant security risks. Convenience and simplicity are often prioritized over strict complexity requirements, reflecting a preference for usability. While some employees use password managers, many still rely on memory. Employees also resist frequent password changes, favoring updates only when security breaches occur. Employees prefer to use modern authentication methods like biometrics and multi-factor authentication, which are secure and user-friendly solutions. However, varying security awareness levels suggest a need for targeted education to address gaps in understanding and improve overall compliance. Originality/value There is currently no prior research exploring password policies from the perspective of government employees in Indonesia, despite the recent surge in cyberattacks targeting government organizations because of weak password practices.