In 2003, the National Institute of Standards and Technology (NIST) stated that strong passwords should consist of upper- and lowercase letters, numbers, and symbols. However, the institute has now reversed its stance. Find out why and learn what their new recommendations are. The problem The issue isn’t that the NIST advised people to create easy-to-crack […]
The post It’s time to rethink your password strategy appeared first on Complete Technology Resources, Inc..
In 2003, the National Institute of Standards and Technology (NIST) stated that strong passwords should consist of upper- and lowercase letters, numbers, and symbols. However, the institute has now reversed its stance. Find out why and learn what their new recommendations are. The problem The issue isn’t that the NIST advised people to create easy-to-crack […]In 2003, the National Institute of Standards and Technology (NIST) stated that strong passwords should consist of upper- and lowercase letters, numbers, and symbols. However, the institute has now reversed its stance. Find out why and learn what their new recommendations are.
The problem
The issue isn’t that the NIST advised people to create easy-to-crack passwords, but their previous advice inadvertently made people generate weak passwords using predictable capitalization, special characters, and numbers, like “P@ssW0rd1.”
Such a password may seem secure, but the string of characters it’s made up of could easily be compromised by hackers using common algorithms.
Furthermore, while the NIST also recommended that people change their passwords regularly, they did not specify how and when to change them. Without proper guidance, many people assumed that this meant adding or changing one or two characters every year or so.
The NIST essentially forced everyone to use passwords that are hard for humans to remember but easy for a hacker’s algorithm to crack.
Eventually, the institution admitted that their recommendation creates more problems than it solves. The NIST has then reversed its stance on organizational password management requirements, and is recommending banishing forced periodic password changes and getting rid of complexity requirements.
The solution
Security consultant Frank Abagnale and Chief Hacking Officer for KnowBe4 Kevin Mitnick both see a future without passwords. Both security experts advise enterprises to implement multifactor authentication (MFA) in login policies.
MFA requires a user to enter one or more valid credentials aside from a password to gain access to an account. This could be a physical security key, a login prompt on a mobile device, or a facial or a fingerprint scan. Without the additional security requirements, hackers' attempts to crack passwords would be futile.
Moreover, Mitnick recommended implementing long passphrases of 25 characters or more, such as “recedemarmaladecrockplacate” or “cavalryfigurineunderdoneexalted.” These are much more difficult to guess and less prone to hacking. Simply put, passwords should be longer and include nonsensical phrases and words that make them almost impossible for an automated system to crack.
What’s more, the NIST recommends making screening of new passwords against lists of common or compromised passwords mandatory. This is because a complex, 25-character password is already considered weak the moment it has been compromised.
Finally, you should also enforce the following security solutions within your company:
- Single sign-on – allows users to securely access multiple accounts with one set of credentials
- Account monitoring tools – recognizes suspicious activity and locks out hackers from the network OR keeps hackers from accessing the network.
When it comes to security, ignorance is your business’s kryptonite. If you’d like to learn about what else you can do to remain secure, just give us a call.
The post It’s time to rethink your password strategy appeared first on Complete Technology Resources, Inc..
Because Microsoft understands the value of business data and the costs associated with data loss and theft, the technology company offers powerful security tools for Microsoft 365 subscribers. However, for these tools to be truly effective, users must implement the following practices to further protect their data. Take advantage of policy alerts Establish policy notifications […]
Most, if not all, cybersecurity experts believe that anything connected to the internet can be hacked. So with the increasing popularity of the Internet of Things (IoT) and IoT devices in the healthcare industry, it’s only wise that organizations understand and address the risks associated with the ubiquity of IoT. Computing devices that contain a […]
Never let your guard down when you’re on social media! Malicious hackers are becoming better at stealing your personal information, so keep these reminders and tips in mind to remain safe while you’re on platforms like Facebook and Twitter. Lock screens exist for a reason Always lock all your devices as soon as you stop […]