Via Security Intelligence
You make password decisions every week. Maybe you create a new account, reset a password or respond to a password change prompt. And each time you make a seemingly small or insignificant mistake in regard to password safety, such as not creating strong enough passwords or using the same password on multiple accounts, you increase your risk.
There are a lot of articles you can read about password safety, and it can be confusing to know who to listen to and what to follow. So we decided to turn to the trusted source for password security: the National Institute of Standards and Technology (NIST) Special Publication 800-63B. The document contains many (many) pages of technical details and lots of government jargon, which makes it hard to read.
What NIST Says About Password Safety
So, we deciphered all the tips for you. Here are five simple actions you should take, both at home and work, to keep your data and network safe. Along with many other tips and guidelines from NIST, these are the most common mistakes and most surprising suggestions.
Don’t select passwords an attacker can easily guess. While this one is a no-brainer, it’s one of the most common mistakes. You can improve your password safety by not using a dictionary word, a password cracked in a previous breach, repetitive characters or a password that is part of your username or the application/service.
The NIST recommends that employers maintain a list of easy-to-guess words that include these types of passwords. From there, they can verify that all passwords are not on the list. Surprisingly, NIST also recommends against checking whether a password meets certain composition requirements beyond being six characters. For example, you may be familiar with systems that ask for special characters or numbers.
Use a password strength meter. The NIST recommends against requiring more than six characters. Instead, it suggests companies use a password strength meter to tell users if their password is strong or weak. Even though it’s not required, most people don’t want to let the strength meter down by using a password in the yellow or red range. Counter to common usage, NIST says organizations shouldn’t require employees to change passwords at specific intervals, such as every month or quarter. Lastly, they recommend only prompting employees to change passwords when the password is compromised or suspected to be compromised.
Use biometrics only in combination with physical authentication. Biometrics are not foolproof. So, you should only use them as one part of two-factor authentication. The second authenticator should be something the person possesses, such as a device. The NIST also recommends that the password safety system should only ask for biometrics after the person has used one method of authentication. That way, the server has proved it is at least partially secure.
Log out of all accounts at least every 30 days. I know I can’t be the only one who possibly hasn’t logged out of some accounts for years. But staying logged in all the time increases the risk of someone being able to steal the password. In addition, businesses should enforce this policy by automatically logging employees out of work-related accounts every 30 days. This requires everyone to prove they are who they say they are once a month. If someone has broken into an account, this requirement limits the damage to shorter time periods.
Use multifactor authentication (MFA). While this is a common recommendation for password safety, the NIST repeats this advice throughout the publication. The statement “multiple factors make successful attacks more difficult to accomplish” really sums up why they recommend MFA. MFA not only makes it harder for an attack to be successful, many threat actors won’t even try to get past the barrier because the success rate is too low for the time needed to crack it. By adding MFA to their systems, especially for actions like changing passwords or accessing work-related networks and sites through a new device, businesses can really improve their security.
A Safe Password Makes for Safe Data
For businesses, every employee multiplies password safety risk. By stealing one credential from a single, poor password decision by an employee, a threat actor can damage an entire organization’s finances and reputation. Yes, it’s really that easy to cause major damage. Not practicing good password hygiene at home can cause similar damage to personal devices and data.
The NIST 800-63B certainly isn’t light reading, but its suggestions are solid. By following these five tips, you can improve both your personal and business password safety.
