https://chrisworth.dev/posts/enterprise-password-security-best-practices/