How to motivate team members
How do I motivate them on other ways then force them so they keep up the "password-spirit" and not just play along for the time I keep an eye out for the issue?
You motivate employees in this regard the same way you'd motivate them with regard to any policy or procedure.
Define. Clearly define and document a password compliance policy, and get it distributed and socialized along with your other corporate policies and procedures. Naturally you will need senior level buy-in to make this happen.
Measure. Set up a system whereby password compliance is periodically audited and the team (not individuals) are given an overall score. It might help politically if this sort of auditing is done by a disinterested party, possibly outside of your immediate organization.
Control. Get management to include team password compliance as a metric which drives performance reviews and/or compensation. For example, if less than 20% of users have poor passwords, the team gets a bonus.
This way you avoid blaming anyone, avoid taking the blame, and make it clear what the requirements are and that you are serious about it.
How do I best respond to phrases like "I've used this password for many years and never had any trouble!" ?
The question of whether a password is good enough is not any individual's decision but a matter of policy. So see above.
Should I escalate deniers to my boss (who put me in charge for the password rules and safety)?
Absolutely, but in a structured way. See above.
Should I threaten deniers that I can escalate this to our boss?
No, never make threats. Threats are taken personally. See above.
Technology can help, even with legacy systems
Poor legacy security is not a problem that is unique to your organization. There are at least two approaches I can think of that would help solve the problem.
- Help users by giving them an enterprise SSO system
An enterprise SSO system can generate random passwords for all of your legacy systems and remember them for your individual employees. When they need to sign on, they provide the SSO password (or sign on to your network using Active Directory credentials, possibly); the SSO system then accesses their password database and fills in the password field in the legacy application. This sort of solution can be made to work with almost all legacy web-based authentication systems.
The nice thing is, it isn't additional work for your team; it's actually less work.
The SSO password itself, of course, can be subjected to whatever password rules you want, because it is a modern system.
- Require 2FA to accessPut the legacy systems behind a modern gateway
Your legacy systems are probably already behind a firewall, router, proxy, or other network appliance. Many of these can be programmed to require a password of their own, and you can use modern password rules there. Until they authenticate, they won't even be able to pull up the legacy system's login page. Once they authenticate, they can access the legacy system, using their crap password. The crappiness of the password doesn't matter much at that point because it is protected by that second factor.