// Password attack types and their effectiveness
const attackMethods = {
  bruteForce: {
    description: "Try every possible combination systematically",
    timeComplexity: "Exponential with password length",
    effectiveness: {
      "8 chars (letters only)": "2 hours",
      "8 chars (mixed case + numbers)": "2 days", 
      "12 chars (mixed + symbols)": "34,000 years"
    },
    countermeasure: "Longer passwords with high entropy"
  },
  
  dictionaryAttack: {
    description: "Use common words and variations",
    timeComplexity: "Minutes to hours",
    effectiveness: {
      "password123": "Instantly cracked",
      "P@ssw0rd": "Minutes", 
      "correct-horse-battery-staple": "Not in dictionary"
    },
    countermeasure: "Avoid dictionary words and common substitutions"
  },
  
  rainbowTable: {
    description: "Precomputed hash lookups",
    timeComplexity: "Seconds",
    effectiveness: {
      "common passwords": "Instant",
      "unique 12+ char passwords": "Not feasible"
    },
    countermeasure: "Long, unique passwords with salt"
  },
  
  socialEngineering: {
    description: "Guess based on personal information",
    timeComplexity: "Minutes to days",
    effectiveness: {
      "birthday + name": "High success rate",
      "pet names + birth year": "Common pattern",
      "completely random": "No advantage"
    },
    countermeasure: "Avoid personal information in passwords"
  }
};

// Entropy calculation for password strength
const entropyCalculation = {
  formula: "Entropy = log₂(possible_combinations)",
  
  characterSets: {
    lowercase: { chars: 26, example: "a-z" },
    uppercase: { chars: 26, example: "A-Z" },
    numbers: { chars: 10, example: "0-9" },
    symbols: { chars: 32, example: "!@#$%^&()" },
    extendedSymbols: { chars: 95, example: "All printable ASCII" }
  },
  
  examples: [
    {
      password: "password",
      length: 8,
      charset: 26, // lowercase only
      entropy: "8  log₂(26) = 37.6 bits",
      strength: "Very Weak"
    },
    {
      password: "Password123",
      length: 11,  
      charset: 62, // letters + numbers
      entropy: "11  log₂(62) = 65.5 bits",
      strength: "Moderate"
    },
    {
      password: "P@ssw0rd!2023",
      length: 13,
      charset: 95, // all printable chars
      entropy: "13  log₂(95) = 84.9 bits", 
      strength: "Strong"
    }
  ]
};

// Comprehensive password evaluation criteria
const strengthCriteria = {
  length: {
    minimum: 8,
    recommended: 12,
    strong: 16,
    scoring: {
      "< 8 chars": 0,
      "8-11 chars": 25,
      "12-15 chars": 50, 
      "16+ chars": 100
    }
  },
  
  characterDiversity: {
    lowercase: { required: true, points: 5 },
    uppercase: { required: true, points: 5 },
    numbers: { required: true, points: 10 },
    symbols: { required: false, points: 25 },
    unicode: { required: false, points: 15 }
  },
  
  patterns: {
    noSequential: { 
      check: "123456, abcdef", 
      penalty: -50,
      examples: ["123456", "abcdef", "qwerty"]
    },
    noRepeating: {
      check: "aaaaaa, 111111",
      penalty: -30,
      threshold: "3+ consecutive identical chars"
    },
    noKeyboard: {
      check: "qwerty, asdf",
      penalty: -40,
      patterns: ["qwertyuiop", "asdfghjkl", "zxcvbnm"]
    }
  }
};

Password Strength Visualization:
┌─────────────────────────────────────────┐
│ Password: MyP@ssw0rd2023!               │
├─────────────────────────────────────────┤
│ Strength: ████████████░░░░ Strong (85%) │
├─────────────────────────────────────────┤
│ ✅ Length: 16 characters               │
│ ✅ Mixed case letters                  │
│ ✅ Contains numbers                    │
│ ✅ Contains symbols                    │
│ ⚠️  Contains dictionary word           │
│ ⚠️  Contains year pattern              │
├─────────────────────────────────────────┤
│ Entropy: 84.2 bits                     │
│ Crack Time: 2.3 trillion years         │
│ Security Level: Enterprise Grade        │
└─────────────────────────────────────────┘

// Password analysis scoring system
const scoringSystem = {
  baseScore: 0,
  maxScore: 100,
  
  lengthScore: (length) => {
    if (length < 8) return 0;
    if (length < 12) return Math.min(25, length  3);
    if (length < 16) return Math.min(50, 25 + (length - 12)  6);
    return Math.min(100, 50 + (length - 16)  3);
  },
  
  complexityScore: (password) => {
    let score = 0;
    if (/[a-z]/.test(password)) score += 5;
    if (/[A-Z]/.test(password)) score += 5; 
    if (/[0-9]/.test(password)) score += 10;
    if (/[^a-zA-Z0-9]/.test(password)) score += 25;
    return score;
  },
  
  penaltyScore: (password) => {
    let penalty = 0;
    
    // Common patterns
    if (/(.)\1{2,}/.test(password)) penalty += 15; // Repeated chars
    if (/123|abc|qwe/i.test(password)) penalty += 20; // Sequential
    if (/password|admin|login/i.test(password)) penalty += 30; // Dictionary
    if (/\d{4}/.test(password)) penalty += 10; // Year patterns
    
    return penalty;
  }
};

// Calculate password entropy and randomness
const entropyAnalysis = {
  calculateEntropy: (password) => {
    const charsets = {
      lowercase: /[a-z]/.test(password) ? 26 : 0,
      uppercase: /[A-Z]/.test(password) ? 26 : 0,
      numbers: /[0-9]/.test(password) ? 10 : 0,
      symbols: /[^a-zA-Z0-9]/.test(password) ? 32 : 0
    };
    
    const totalChars = Object.values(charsets).reduce((sum, count) => sum + count, 0);
    const entropy = password.length  Math.log2(totalChars);
    
    return {
      entropy: Math.round(entropy  10) / 10,
      charset: totalChars,
      classification: classifyEntropy(entropy)
    };
  },
  
  classifyEntropy: (entropy) => {
    if (entropy < 30) return "Very Weak";
    if (entropy < 50) return "Weak"; 
    if (entropy < 70) return "Moderate";
    if (entropy < 90) return "Strong";
    return "Very Strong";
  },
  
  crackTimeEstimate: (entropy) => {
    // Assuming 1 billion guesses per second
    const combinations = Math.pow(2, entropy);
    const averageAttempts = combinations / 2;
    const seconds = averageAttempts / 1000000000;
    
    return formatTime(seconds);
  }
};

// Advanced pattern recognition in passwords
const patternDetection = {
  commonPatterns: {
    keyboard: {
      qwerty: /qwerty|asdf|zxcv/i,
      sequences: /123|abc|xyz/i,
      adjacent: /qaz|wsx|edc/i
    },
    
    substitution: {
      simple: /[a@][s$][e3][o0]/i, // Common letter-to-symbol
      leet: /h4ck3r|p4ssw0rd|3l1t3/i // Leet speak
    },
    
    personal: {
      dates: /19\d{2}|20\d{2}/, // Birth years, etc.
      names: /john|smith|admin/i, // Common names
      words: /love|money|family/i // Emotional words
    },
    
    structural: {
      bookends: /^[A-Z].[!@#$]$/, // Capital + symbol pattern
      middle: /^.{4,}[0-9]+.{4,}$/, // Numbers in middle
      chunks: /(.{3,})\1/i // Repeated chunks
    }
  },
  
  analyzePatterns: (password) => {
    const findings = [];
    
    Object.entries(patternDetection.commonPatterns).forEach(([category, patterns]) => {
      Object.entries(patterns).forEach(([type, regex]) => {
        if (regex.test(password)) {
          findings.push({
            category,
            type, 
            severity: getSeverity(category, type),
            recommendation: getRecommendation(category, type)
          });
        }
      });
    });
    
    return findings;
  }
};

// Analysis of commonly used passwords
const commonPasswords = {
  top10_2023: [
    { password: "123456", occurrences: "4.9 million", crackTime: "instant" },
    { password: "password", occurrences: "4.1 million", crackTime: "instant" },
    { password: "123456789", occurrences: "2.9 million", crackTime: "instant" },
    { password: "guest", occurrences: "2.3 million", crackTime: "instant" },
    { password: "qwerty", occurrences: "2.1 million", crackTime: "instant" },
    { password: "12345678", occurrences: "1.9 million", crackTime: "instant" },
    { password: "111111", occurrences: "1.8 million", crackTime: "instant" },
    { password: "12345", occurrences: "1.6 million", crackTime: "instant" },
    { password: "col123456", occurrences: "1.4 million", crackTime: "instant" },
    { password: "123123", occurrences: "1.3 million", crackTime: "instant" }
  ],
  
  categories: {
    numerical: ["123456", "111111", "000000"],
    keyboard: ["qwerty", "asdfgh", "zxcvbn"],
    words: ["password", "admin", "login", "welcome"],
    names: ["michael", "jennifer", "jordan"],
    years: ["2023", "1990", "1985", "2000"]
  },
  
  variations: {
    capitalization: ["Password", "PASSWORD", "PassWord"],
    substitution: ["P@ssw0rd", "Passw0rd", "P4ssword"],
    appending: ["password123", "password!", "password2023"]
  }
};

// Analysis against known data breaches
const breachAnalysis = {
  checkAgainstBreaches: (passwordHash) => {
    // Using k-anonymity with HaveIBeenPwned API
    const hashPrefix = passwordHash.substring(0, 5);
    
    return {
      breached: true/false,
      occurrences: 0, // Number of times seen in breaches
      databases: [], // Which breach databases contained this password
      recommendation: "Change password immediately if breached"
    };
  },
  
  majorBreaches: {
    rockyou: {
      year: 2009,
      passwords: "32 million",
      impact: "Revealed common password patterns"
    },
    linkedin: {
      year: 2012, 
      passwords: "117 million",
      impact: "Professional passwords analyzed"
    },
    yahoo: {
      year: 2013,
      passwords: "1 billion",
      impact: "Largest password breach in history"
    },
    collection1: {
      year: 2019,
      passwords: "773 million", 
      impact: "Credential stuffing compilation"
    }
  }
};

// Detecting personal information in passwords
const personalInfoDetection = {
  commonPersonalData: {
    names: {
      patterns: [/john|jane|mike|lisa/i],
      risk: "High - easily guessable from social media",
      examples: ["John123", "MikeP@ss"]
    },
    
    birthdays: {
      patterns: [/\b(19|20)\d{2}\b/, /\b(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])\b/],
      risk: "High - often publicly available",
      examples: ["Password1990", "MyPass0315"]
    },
    
    familyPets: {
      patterns: [/max|buddy|bella|charlie|lucy/i],
      risk: "Medium - shared on social media",
      examples: ["Max123!", "BellaLove"]
    },
    
    locations: {
      patterns: [/newyork|london|paris|tokyo/i],
      risk: "Medium - derived from profiles",
      examples: ["London2023", "NYC@home"]
    },
    
    interests: {
      patterns: [/football|music|travel|coffee/i],
      risk: "Medium - visible in online activity",
      examples: ["Football123", "CoffeeLover!"]
    }
  },
  
  riskAssessment: (password, userContext = {}) => {
    const risks = [];
    
    // Check against user's known information
    if (userContext.name && new RegExp(userContext.name, 'i').test(password)) {
      risks.push({
        type: "Personal Name",
        severity: "High",
        recommendation: "Never use your name in passwords"
      });
    }
    
    if (userContext.birthYear && password.includes(userContext.birthYear)) {
      risks.push({
        type: "Birth Year",
        severity: "High", 
        recommendation: "Avoid using birth year or any personal dates"
      });
    }
    
    return risks;
  }
};

// Generating secure passphrases
const passphraseGeneration = {
  diceware: {
    description: "Use dice rolls to select random words",
    method: "Roll 5 dice, lookup word in Diceware list",
    example: "correct horse battery staple",
    entropy: "12.9 bits per word",
    recommended: "6-8 words for high security"
  },
  
  randomWords: {
    description: "Combine unrelated dictionary words",
    method: "Select words from different categories",
    example: "sunset-keyboard-elephant-97",
    entropy: "Varies by word list size",
    recommended: "4-6 words with numbers/symbols"
  },
  
  sentenceMethod: {
    description: "Use memorable sentence structure",
    method: "Create sentence, take first letters + modifications",
    example: "I love 2 eat pizza on Fridays! → Il2epoF!",
    entropy: "Depends on sentence complexity",
    recommended: "Long sentences with numbers/symbols"
  },
  
  comparison: {
    passphrase: {
      example: "correct-horse-battery-staple-27",
      length: 34,
      entropy: "77 bits",
      memorability: "High",
      typing: "Easy"
    },
    complex: {
      example: "Tr0ub4dor&3",
      length: 11,
      entropy: "56 bits",
      memorability: "Low", 
      typing: "Moderate"
    }
  }
};

// Secure password generation guidelines
const generationRules = {
  length: {
    minimum: 12,
    recommended: 16,
    high_security: 20,
    rationale: "Each additional character exponentially increases crack time"
  },
  
  characterSet: {
    required: [
      "Lowercase letters (a-z)",
      "Uppercase letters (A-Z)", 
      "Numbers (0-9)"
    ],
    recommended: [
      "Special characters (!@#$%^&*)",
      "Extended symbols ({}[]|\\:;\"'<>?)"
    ],
    avoid: [
      "Ambiguous characters (0O, l1I)",
      "Non-printable characters",
      "Characters that cause encoding issues"
    ]
  },
  
  structure: {
    randomness: "True randomness preferred over patterns",
    noPatterns: "Avoid keyboard walks, repeated sequences",
    noDictionary: "Don't use dictionary words as base",
    noPersonal: "No personal information whatsoever"
  },
  
  examples: {
    weak: {
      password: "Password123!",
      issues: ["Dictionary word base", "Predictable structure", "Common substitutions"]
    },
    strong: {
      password: "Mx7$kP9&nQ2#vB8@",
      benefits: ["High entropy", "No patterns", "Mixed character types", "16+ characters"]
    }
  }
};

// Step-by-step password improvement
const improvementPath = {
  initial: "password",
  
  steps: [
    {
      step: 1,
      action: "Capitalize some letters",
      result: "Password",
      improvement: "Minimal - still easily cracked",
      entropy: "+4.7 bits"
    },
    {
      step: 2,
      action: "Add numbers at end",
      result: "Password123",
      improvement: "Slight - common pattern",
      entropy: "+10 bits"
    },
    {
      step: 3,
      action: "Add special characters",
      result: "Password123!",
      improvement: "Moderate - still predictable",
      entropy: "+6.6 bits"
    },
    {
      step: 4,
      action: "Replace with unrelated words",
      result: "Elephant-Keyboard-97",
      improvement: "Good - less predictable",
      entropy: "+25 bits"
    },
    {
      step: 5,
      action: "Use completely random generation",
      result: "Mx7$kP9&nQ2#vB8@", 
      improvement: "Excellent - maximum entropy",
      entropy: "+40 bits"
    }
  ],
  
  recommendations: [
    "Skip weak iterations and jump to strong password",
    "Use password manager for generation and storage",
    "Each password should be unique across all accounts",
    "Regularly audit and update important passwords"
  ]
};

// Password manager security benefits
const passwordManagerBenefits = {
  unique_passwords: {
    problem: "Password reuse across multiple accounts",
    solution: "Generate unique password for each account",
    impact: "Eliminates credential stuffing attack risk",
    statistics: "Average person has 100+ online accounts"
  },
  
  high_complexity: {
    problem: "Users choose simple, memorable passwords",
    solution: "Generate maximum complexity passwords",
    impact: "Exponentially increases crack time",
    example: "64-character random vs 8-character memorable"
  },
  
  secure_storage: {
    problem: "Password storage in browsers or documents",
    solution: "Encrypted vault with master password",
    impact: "Even if breached, passwords remain encrypted",
    encryption: "AES-256 with PBKDF2/Argon2"
  },
  
  breach_response: {
    problem: "Unknown when passwords are compromised",
    solution: "Automated breach monitoring and alerts",
    impact: "Immediate notification and password change",
    integration: "HaveIBeenPwned API integration"
  }
};

// Password manager feature comparison
const passwordManagers = {
  bitwarden: {
    pricing: "Free tier available, $3/month premium",
    features: [
      "Unlimited passwords on free tier",
      "Cross-platform sync",
      "Password sharing",
      "Security audit reports"
    ],
    security: "Zero-knowledge architecture, open source",
    recommendation: "Best overall value"
  },
  
  lastpass: {
    pricing: "$3/month personal, $4/month families",
    features: [
      "Advanced multi-factor authentication", 
      "Emergency access",
      "Dark web monitoring",
      "Password inheritance"
    ],
    security: "AES-256 encryption, security center",
    recommendation: "Good for families"
  },
  
  onepassword: {
    pricing: "$3/month individual, $5/month family",
    features: [
      "Travel Mode",
      "Watchtower security alerts",
      "Document storage",
      "Team management"
    ],
    security: "Secret Key + master password",
    recommendation: "Best for business users"
  },
  
  dashlane: {
    pricing: "Free limited, $5/month premium",
    features: [
      "Password health scoring",
      "VPN included",
      "Identity theft protection",
      "Auto-fill and auto-login"
    ],
    security: "Zero-knowledge with biometric unlock",
    recommendation: "Most user-friendly"
  }
};

// Creating secure master passwords
const masterPasswordStrategy = {
  requirements: {
    length: "20+ characters recommended",
    memorability: "Must be memorable without writing down",
    uniqueness: "Used nowhere else, ever",
    complexity: "High entropy but typeable"
  },
  
  creation_methods: {
    passphrase: {
      example: "zebra-moonlight-compass-birthday-47",
      benefits: ["Easy to remember", "High entropy", "Typeable"],
      method: "5-7 random words + number"
    },
    
    sentence: {
      example: "My favorite book is 1984 by George Orwell! → MfbI1984bGO!",
      benefits: ["Personal meaning", "Mixed characters"],
      method: "Memorable sentence → acronym + modifications"
    },
    
    hybrid: {
      example: "coffee-Morning-2023-$keyboard",
      benefits: ["Multiple word types", "Visual memory cues"],
      method: "Combine different word categories"
    }
  },
  
  security_tips: [
    "Never store master password digitally",
    "Consider sharing with trusted family member",
    "Practice typing it regularly",
    "Have emergency access plan",
    "Change if ever compromised"
  ]
};

// GDPR requirements for password handling
const gdprCompliance = {
  dataProtection: {
    principle: "Passwords must be protected by appropriate technical measures",
    requirements: [
      "Pseudonymisation and encryption",
      "Ongoing confidentiality and integrity",
      "Regular testing of security measures",
      "Breach notification within 72 hours"
    ]
  },
  
  userRights: {
    access: "Users can request password policy information",
    rectification: "Users can update password requirements",
    erasure: "Password hashes must be deletable",
    portability: "Limited applicability to passwords"
  },
  
  technicalMeasures: [
    "Salt + hash storage (never plaintext)",
    "Secure transmission (HTTPS/TLS)",
    "Access logging and monitoring",
    "Regular security assessments"
  ]
};

// Password requirements by industry
const industryStandards = {
  financial: {
    standards: ["PCI DSS", "SOX", "FFIEC"],
    requirements: {
      length: "Minimum 8 characters, recommend 12+",
      complexity: "3 of 4 character types required",
      expiration: "90-day maximum for admin accounts",
      history: "Remember last 12 passwords",
      lockout: "Lock after 6 failed attempts"
    }
  },
  
  healthcare: {
    standards: ["HIPAA", "HITECH"],
    requirements: {
      length: "Minimum 8 characters",
      complexity: "Mixed case, numbers, symbols",
      expiration: "90 days or less",
      uniqueness: "Must be unique across systems",
      access: "Role-based password requirements"
    }
  },
  
  government: {
    standards: ["NIST SP 800-63B", "FISMA"],
    requirements: {
      length: "Minimum 12 characters",
      complexity: "No complexity requirements if length >15",
      expiration: "No mandatory expiration",
      screening: "Check against breach databases",
      mfa: "Multi-factor authentication required"
    }
  },
  
  enterprise: {
    standards: ["ISO 27001", "SOC 2"],
    requirements: {
      length: "Organization-defined minimum",
      policy: "Documented password policy",
      monitoring: "Regular password audits",
      training: "User security awareness",
      incident: "Breach response procedures"
    }
  }
};

// Modern NIST password guidelines
const nistGuidelines = {
  memorable_secrets: {
    length: "Minimum 8 characters, no maximum",
    composition: "No character composition requirements",
    rationale: "Length more important than complexity"
  },
  
  prohibited_requirements: {
    expiration: "No periodic password changes without incident",
    hints: "No password hints allowed",
    knowledge: "No use of personal information",
    sms: "SMS not recommended for 2FA"
  },
  
  verification: {
    attempts: "Limit consecutive failed attempts",
    throttling: "Rate limiting on verification",
    screening: "Check against compromise databases",
    salt: "Use unique salt for each password"
  },
  
  storage: {
    hashing: "Use approved cryptographic hash (bcrypt, PBKDF2, Argon2)",
    parameters: "Proper iteration counts and memory requirements",
    pepper: "Optional additional secret for hash function"
  }
};

// Two-factor authentication setup
const twoFactorAuth = {
  types: {
    totp: {
      name: "Time-based One-Time Password",
      apps: ["Google Authenticator", "Authy", "Microsoft Authenticator"],
      security: "High - not phishable via SMS",
      usability: "Good - works offline"
    },
    
    sms: {
      name: "SMS Text Message",
      implementation: "Send code via text message",
      security: "Medium - vulnerable to SIM swapping",
      usability: "High - familiar to users"
    },
    
    hardware: {
      name: "Hardware Security Keys",
      standards: ["FIDO2", "WebAuthn", "U2F"],
      security: "Very High - phishing resistant",
      usability: "Medium - requires physical device"
    },
    
    biometric: {
      name: "Biometric Authentication",
      types: ["Fingerprint", "Face ID", "Voice recognition"],
      security: "High - unique to individual",
      usability: "Very High - convenient"
    }
  },
  
  implementation_priority: [
    "1. Hardware keys for high-value accounts",
    "2. TOTP apps for general use", 
    "3. SMS only as backup method",
    "4. Biometric for device-local authentication"
  ]
};

// Adaptive authentication based on risk signals
const riskBasedAuth = {
  risk_factors: {
    location: {
      normal: "Usual city/country of access",
      suspicious: "New country or unusual location",
      action: "Require additional verification"
    },
    
    device: {
      normal: "Recognized browser/device fingerprint",
      suspicious: "New device or modified fingerprint",
      action: "Email verification + 2FA"
    },
    
    behavior: {
      normal: "Typical login times and usage patterns",
      suspicious: "Unusual hours or rapid location changes",
      action: "Step-up authentication required"
    },
    
    network: {
      normal: "Home/office IP addresses",
      suspicious: "Tor, VPN, or known bad IP ranges",
      action: "Enhanced security verification"
    }
  },
  
  response_levels: {
    low_risk: "Standard password authentication",
    medium_risk: "Password + email confirmation",
    high_risk: "Password + 2FA + security questions",
    very_high_risk: "Account temporary lock + manual review"
  }
};

// Protecting against credential stuffing attacks
const credentialStuffingProtection = {
  detection_methods: {
    velocity: "Monitor login attempt frequency per IP/account",
    patterns: "Detect systematic username/password testing",
    fingerprinting: "Track device and browser characteristics",
    behavior: "Analyze mouse movements and typing patterns"
  },
  
  mitigation_strategies: {
    rate_limiting: {
      implementation: "Limit login attempts per IP/account",
      parameters: "5 attempts per minute, 20 per hour",
      bypass: "Whitelist known good IPs"
    },
    
    captcha: {
      trigger: "After 3 failed attempts",
      type: "reCAPTCHA v3 for seamless experience",
      effectiveness: "Blocks automated attacks"
    },
    
    geoblocking: {
      implementation: "Block countries with no legitimate users",
      consideration: "May affect VPN users",
      override: "Allow with additional verification"
    },
    
    device_fingerprinting: {
      tracking: "Browser, OS, screen resolution, timezone",
      storage: "Link fingerprint to successful logins",
      detection: "Flag rapid fingerprint changes"
    }
  }
};

// Enterprise password policy framework
const passwordPolicy = {
  scope: {
    applicability: "All employees, contractors, and system accounts",
    systems: "All corporate systems, applications, and services",
    exceptions: "Legacy systems with documented compensating controls"
  },
  
  requirements: {
    user_accounts: {
      length: "Minimum 12 characters", 
      complexity: "Mix of uppercase, lowercase, numbers, symbols",
      uniqueness: "Unique across all corporate systems",
      expiration: "Change only when compromised",
      sharing: "Prohibited - individual accountability required"
    },
    
    administrative_accounts: {
      length: "Minimum 15 characters",
      complexity: "High entropy, randomly generated preferred",
      mfa: "Multi-factor authentication mandatory",
      monitoring: "All access logged and monitored",
      review: "Quarterly access review and validation"
    },
    
    service_accounts: {
      length: "Minimum 20 characters",
      generation: "Cryptographically secure random generation",
      storage: "Encrypted password vault with access logging",
      rotation: "Automated rotation every 90 days",
      documentation: "Inventory and ownership documentation"
    }
  },
  
  implementation: {
    technical_controls: [
      "Password complexity validation",
      "Breach database screening", 
      "Password manager deployment",
      "Single sign-on implementation"
    ],
    
    training: [
      "Annual security awareness training",
      "Password best practices education",
      "Phishing simulation and response",
      "Incident reporting procedures"
    ],
    
    monitoring: [
      "Failed login attempt monitoring",
      "Privileged account activity logging",
      "Regular password audit scanning",
      "Compliance assessment reporting"
    ]
  }
};

// Technical enforcement of password policies
const policyEnforcement = {
  active_directory: {
    group_policy: {
      min_length: "Set minimum password length",
      complexity: "Enforce character type requirements",
      history: "Remember previous N passwords",
      lockout: "Account lockout after failed attempts"
    },
    
    fine_grained_policy: {
      scope: "Different policies for different user groups",
      admin_accounts: "Stricter requirements for administrators",
      service_accounts: "Automated compliance for service accounts"
    }
  },
  
  application_level: {
    validation: "Real-time password strength checking",
    blocking: "Prevent weak passwords at creation",
    guidance: "Provide improvement suggestions",
    integration: "Connect with password managers"
  },
  
  monitoring_tools: {
    password_auditing: "Regular scans for weak passwords",
    breach_monitoring: "Alert on compromised credentials",
    compliance_reporting: "Generate policy adherence reports",
    risk_assessment: "Identify high-risk accounts"
  }
};

// Complete password lifecycle management
const passwordLifecycle = {
  creation: {
    generation: "Use cryptographically secure random generation",
    validation: "Verify against security policy requirements", 
    screening: "Check against known breach databases",
    storage: "Store securely with appropriate encryption"
  },
  
  active_use: {
    monitoring: "Continuous monitoring for compromise indicators",
    access_logging: "Log all authentication attempts",
    risk_assessment: "Regular evaluation of account risk level",
    user_education: "Ongoing security awareness training"
  },
  
  maintenance: {
    breach_response: "Immediate change when compromise detected",
    scheduled_review: "Periodic password strength assessment",
    policy_updates: "Adapt to evolving security requirements",
    technology_refresh: "Upgrade hashing algorithms as needed"
  },
  
  retirement: {
    secure_deletion: "Cryptographically secure password erasure",
    audit_trail: "Maintain logs per retention policy",
    system_cleanup: "Remove from all connected systems",
    documentation: "Update security documentation"
  }
};

// Password breach incident response
const breachResponse = {
  detection: {
    sources: [
      "Security monitoring alerts",
      "User reports of compromise",
      "Threat intelligence feeds",
      "Third-party breach notifications"
    ],
    
    indicators: [
      "Unusual login patterns",
      "Geographic anomalies", 
      "Multiple failed attempts",
      "Suspicious account activity"
    ]
  },
  
  immediate_response: {
    containment: [
      "Lock affected accounts immediately",
      "Block suspicious IP addresses",
      "Disable compromised services",
      "Isolate affected systems"
    ],
    
    assessment: [
      "Determine scope of compromise",
      "Identify affected accounts/systems",
      "Assess data exposure risk",
      "Document timeline of events"
    ]
  },
  
  remediation: {
    password_changes: [
      "Force password reset for affected accounts",
      "Require MFA setup for all users",
      "Implement enhanced monitoring",
      "Update security policies"
    ],
    
    communication: [
      "Notify affected users immediately",
      "Provide clear remediation steps",
      "Update security awareness training",
      "Issue public disclosure if required"
    ]
  },
  
  recovery: {
    monitoring: "Enhanced monitoring for 90+ days",
    validation: "Verify all accounts secured",
    lessons_learned: "Document improvements needed",
    policy_updates: "Strengthen security policies"
  }
};