We have a system (e.g. purchasing) where there are multiple access points. One is a back-end desktop application only accessible by employees within the LAN, the other is an Internet accessible Web Application by a subset of employees as well as customers. Both require authenticating with a Username and password.
The Web Application requires a stricter password policy than the back-end application, however we want to allow the Employees to access both with at least the same Username (at the moment they log in as a different user).
Should we be requiring the employees to use different password when logging in via the Web Application? Or should we use the same password but require the stricter password policy for the subset of employees for the back-end application as well?