Password Settings + Hard and Soft Tokens

Length

which has typically been one of the best controls to prevent passwords brute forcing

Complexity

which influences password attacks by ensuring that larger character sets are required for brute-force attacks and in many implementations, also prevents the use of common words or a series of repeated characters

Reuse limitations

are set to ensure that users don’t simply set their password to a previous password, which may have been exposed, reused, or compromised

Expiration dates

Are set to ensure that passwords are not used for extended periods of time. Expiration dates often create additional support work for help desks, which means many organizations have moved to not requiring password changes as frequently — or ever — if they have multifactor authentication (MFA) in place

Age settings

for passwords are used to ensure that users do not simply reset their passwords over and over until they bypass reuse limitations, allowing them to return to their former password

A USB security key is an example of

a hard, or physical, token

An application is an example of

a soft token