The National Institute of Standards and Technology (NIST) created many of the password best practices you probably loathe — using a combination of letters, numbers, and special characters. The NIST now says those guidelines were ill-advised and has changed its stance. Find out why and what this means for you. The problem The issue isn’t […]
The post Think your password is secure? Think again appeared first on Complete Technology Resources, Inc..
The National Institute of Standards and Technology (NIST) created many of the password best practices you probably loathe — using a combination of letters, numbers, and special characters. The NIST now says those guidelines were ill-advised and has changed its stance. Find out why and what this means for you. The problem The issue isn’t […]The National Institute of Standards and Technology (NIST) created many of the password best practices you probably loathe — using a combination of letters, numbers, and special characters. The NIST now says those guidelines were ill-advised and has changed its stance. Find out why and what this means for you.
The problem
The issue isn’t that the NIST advised people to create easy-to-crack passwords, but their previous advice inadvertently made people create weak passwords using predictable capitalization, special characters, and numbers, like “P@ssW0rd1.”
Such a password may seem secure, but the strings of characters and numbers could easily be compromised by hackers using common algorithms.
What’s more, the NIST also recommended that people change their passwords regularly, but did not specify how and when to change them. Since many people thought their passwords were already secure because they’ve included special characters in them, most only added or changed one character.
The NIST essentially forced everyone to use passwords that are hard for humans to remember but easy for a hacker’s algorithm to crack.
Eventually, the institution admitted that this can cause more problems than solutions. It has reversed its stance on organizational password management requirements, and is now recommending banishing forced periodic password changes and getting rid of complexity requirements.
The solution
Security consultant Frank Abagnale and Chief Hacking Officer for KnowBe4 Kevin Mitnick both see a future without passwords. Both security experts advise enterprises to implement multifactor authentication in login policies.
This requires a user to present two valid credentials aside from a password to gain access to an account. This could be a code sent to the account owner’s smartphone, a login prompt on a mobile device, or a facial or a fingerprint scan. This way, hackers’ login efforts are futile unless they fulfill the succeeding security requirements.
Moreover, Mitnick recommended implementing long passphrases of 25 characters or more, such as “recedemarmaladecrockplacate” or “cavalryfigurineunderdoneexalted.” These are much more difficult to guess and less prone to hacking. As for the frequency of changing passphrases, it will depend on a company’s risk tolerance.
Simply put, passwords should be longer and include nonsensical phrases and English words that make it almost impossible for an automated system to crack.
You should also enforce the following security solutions within your company:
- Single sign-on – allows users to securely access multiple accounts with one set of credentials
- Account monitoring tools – recognizes suspicious activity and locks out hackers
When it comes to security, ignorance is your business’s kryptonite. If you’d like to learn about what else you can do to remain secure, just give us a call.
The post Think your password is secure? Think again appeared first on Complete Technology Resources, Inc..
Businesses these days need different kinds of software to streamline and improve their operations. However, a lot of small businesses can’t readily afford these software. But there is a way to harness the power of such software without draining your resources. Learn more about Software-as-a-Service (SaaS), and how your business can benefit from it. What […]
Over the past few years, the security industry has witnessed a rapid evolution in attack techniques, including fileless malware. Now, cybercriminals use legitimate tools and services such as existing software, applications, and authorized protocols to carry out malicious activities like unauthorized data retrieval or data damage. Left unchecked, these types of malware can adversely affect […]
As you surf the web, it’s nearly impossible to keep your internet activity completely private. Certain websites collect personal information for marketing purposes and your browser keeps track of all the websites you visit. That browsing information can also fall into the wrong hands, which is why you should consider using private browsing if you […]