In the context of plain text passwords, here are the most concerning policies:
* Passwords must be 8 to 16 characters in length.
While setting a maximum length of 16 characters may simply be a misguided or misinformed policy, it most likely points to how the system is storing the password and compatibility with legacy systems.
The biggest issue here would be if the database field was set at 16 characters and they are storing the passwords as plain text. If this is the case, the system is completely insecure.
However, they could also be using a hash such as crypt16 that limits the password length to 16 characters, although this is not widely used and less likely the explanation. If this is the case, the system is dangerously insecure.
Another reason could be that they are using MD5 and someone determined that due to collisions there is little to gain by allowing passwords longer than 16 characters. Although this logic is flawed, I have seen it happen. If this is the case, the system is still dangerously insecure.
I think the most likely explanation is that they are encrypting passwords and not hashing them, which means they are storing the encryption key somewhere which is also dangerously insecure.
Hopefully the reason for this has to do with limitations buried somewhere in a massive code base they are afraid to touch and they are actually storing the passwords using SHA256, but unfortunately that is not likely. The most likely problem here is that they are dangerously insecure.
* Users may not re-use the previous eight passwords.
To determine this they must be storing the your previous eight passwords. Seeing that they are most likely using plaintext, a weak hashing algorithm, or reversible encryption, this means that 9 passwords for every user are potentially at risk.
* Passwords must contain at least:
- One alphabetic character
- One numeric character
- One of the following special characters: @, #, $
If the password is hashed or even encrypted, the characters used should not make any difference, as long as they are printable and within the current code page. The fact the they limit this to so few characters strongly indicates that the passwords might be stored in plaintext.
* When changing a password, the new password must not contain more than
three consecutive characters from the previous password.
This can be compared at the point where passwords are changed, so it is not a strong indicator either way.
This is off topic, but the following policies are misguided and obsolete attempts at making stronger passwords. A higher minimum password length would eliminate the need for all of these.
* Passwords must be updated every 90 days.
* Passwords must contain a non-numeric in the first and last positions.
* Passwords may not contain two consecutive identical characters.
* Passwords may not contain a dictionary word or proper noun.