There was no password policy defined at application level. However, password was forced at operating system level by Active Directory. Application cannot not add and modify data. In addition, the unauthorised person cannot not access the production line from outside.