When your IT department creates a new website for users to access, how  do they go about securing it? 

If you are like most IT departments, you  require users to make use of a unique username and a password.  That password may be a bit complex: it has to be so long, must contain  upper and lower characters, has to have a special character in it, etc.  However, we keep reading about hackers who are able to guess people’s  passwords and gain access to sites. 

What should a CIO do to stop this?