User passwords are often a weak link in the corporate security chain. How can security pros make users adhere to strong password policies?