Contact Us Today! 800-626-8277

One World Technology Inc. Blog

One World Technology Inc. has been serving the Medina area since 2012, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.

Understanding the New NIST Guidelines for Password Security

Understanding the New NIST Guidelines for Password Security

The National Institute for Standards and Technology (NIST) has released Special Publication 800-63B, titled Digital Identity Guidelines. The document outlines major changes to the ways password security should be approached and leaves a lot of what network administrators and software developers have implemented recently to be wrong Today, we’ll take a look at the publication, and try to make sense of the sudden change of course.

NIST is a non-regulatory federal agency that works under the umbrella of the U.S. Department of Commerce. Its mission is to promote U.S. innovation and competitiveness by advancing a uniform measurement standard. Many NIST guidelines become the foundation for best practices in data security. As a result, any publication they produce having to do with cyber or network security should be considered.

A Look at SP 800-63B
The newest password guidelines are a swift about-face in strategy as compared to previous NIST suggestions. Instead of a strategy of ensuring that all passwords meet some type of arbitrary complexity requirements, the new strategy is to create passwords that are easier and more intuitive. Here are some of the highlights:

  • Passwords should be compared to dictionaries and commonly-used passwords
  • Eliminate or reduce complexity rules for passwords
  • All printable characters allowed, including spaces
  • Expiration of passwords no longer based on time password has been in use
  • Maximum length increased to 64 characters.

Basically, the new guidelines recommend longer passphrases to the complex passwords as they are hard for people to remember, and even with complexity rules in place, it was becoming increasingly easy for algorithms to crack passwords (seen in the comic strip below).

ib nist cartoon 1

As stated before, NIST is not a regulatory organization, but federal agencies and contractors use NIST’s information in order to set up secure computing environments in which to display, store, and share sensitive unclassified information.

In making these changes to password strategy, NIST is now considering the fact that many industry professionals knew: a password you can’t remember may be secure, but if it’s so secure that you have to rely on third-party software to utilize it, it’s not really that effective at mitigating risk. NIST now looks at the passphrase strategy, along with two-factor authentication as the go-to risk management strategy. SMS-based two-factor authentication was not mentioned in the final report but has come under scrutiny as it has contributed to multiple hacks in recent times.

The NIST also explicitly commands that network administrators be mindful to forbid commonly used passwords; effectively creating a blacklist of passwords. The new guidelines also suggest that users shouldn’t be using the password hints or knowledge-based authentication options; a common practice among banking and FinTech applications to this day. We’ll see if there is a strategic alteration in these companies’ practices as the new NIST guidelines become best practices.

If you are looking for more information about best password practices and data security, the IT experts at One World Technology Inc. are here to help. Call us today at 800-626-8277 to have your password strategy assessed by the professionals.

Comic by XKCD.

Cryptomining is Inspiring Cybercrime
Know Your Tech: CMS
 

Comments

No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Guest
Monday, July 16 2018
If you'd like to register, please fill in the username, password and name fields.

Captcha Image

Sign up for our Newsletter!

Powered by ChronoForms - ChronoEngine.com

Mobile? Grab this Article!

QR-Code dieser Seite

Tag Cloud

Tip of the Week Security Privacy Best Practices Technology Cloud Network Security Business Computing Managed IT Services Backup Malware Hackers Hosted Solutions Outsourced IT Software Google VoIP Microsoft Business Continuity Data Backup Business Data Email Disaster Recovery Mobile Devices IT Support Windows 10 Ransomware Data Recovery Innovation Efficiency Smartphones Android Saving Money Cybercrime Cloud Computing Internet Communications Computer Internet of Things Browser Productivity IT Services Hardware Tech Term Small Business Alert BDR Computers Business Management Office Smartphone Managed IT Server Virtualization Law Enforcement Cybersecurity User Tips Productivity Artificial Intelligence Save Money Mobility Collaboration Passwords Chrome Windows Work/Life Balance Password How To Communication Router Telephone Systems Managed IT Services Private Cloud Data Protection Social Media Wi-Fi Flexibility Holiday Health Hacking Data Security Office Tips Mobile Device Management Avoiding Downtime App Remote Monitoring Money Phishing Business Intelligence Quick Tips Network Firewall Office 365 Budget Social Engineering Facebook Document Management Redundancy HaaS Upgrade Spam Bring Your Own Device Automation Vulnerability Proactive IT Miscellaneous Apps Two-factor Authentication Workplace Tips Data Breach Information Technology Applications Bandwidth Value Connectivity Identity Theft Compliance BYOD Word Mobile Device Recovery Big Data Managed Service Provider Gadgets Paperless Office Unsupported Software Save Time Electronic Medical Records Infrastructure Workers Entertainment Charger Public Cloud Comparison Remote Computing Hiring/Firing Data loss Update Patch Management USB Automobile Computing Infrastructure Black Market Scam Risk Management Cleaning PDF Marketing Battery Data Management Computer Care Google Drive Analysis Government Education Employer-Employee Relationship Data Storage Website Windows 7 VPN Solid State Drive History Microsoft Office End of Support Legal HIPAA Windows 10 Networking Worker CES OneNote Content Filtering Content Management IT Management Credit Cards Spam Blocking Servers SaaS Business Owner Two Factor Authentication IT Support Training Blockchain IT Plan Smart Tech Operating System Keyboard Google Apps Root Cause Analysis Travel Books Mobile Computing Audiobook Vendor Management Human Resources NIST Relocation Insurance Amazon Streaming Media Users Windows 10s Experience Assessment Students Current Events Outlook Video Games Staff Cryptocurrency Software Tips Practices Amazon Web Services Content Filter Sync Music Television Password Manager Healthcare Meetings Software as a Service Emergency Knowledge Frequently Asked Questions Hybrid Cloud Digital Signature Safe Mode Humor Physical Security Hosted Computing Online Shopping Storage Audit Telephony Wearable Technology Public Computer Colocation Business Mangement Electronic Health Records Network Congestion Specifications Emails Excel Unified Threat Management Scalability Encryption Inventory Evernote Skype Employer Employee Relationship Gmail Machine Learning Screen Mirroring HBO Millennials Tip of the week Strategy Access Control Wireless Charging Addiction Computer Fan Start Menu Troubleshooting Transportation Leadership Computer Accessories hacker Recycling YouTube Cast Google Docs Workforce Windows Server 2008 Politics Instant Messaging Virtual Assistant Authentication Files Fiber-Optic Cache The Internet of Things Mobile Safety Hard Drives Benefits Bluetooth Internet Exlporer eWaste Telecommuting Netflix Samsung Nanotechnology Cables Wireless Internet FENG Professional Services Hosted Solution Smart Technology Criminal Downtime Voice over Internet Protocol Remote Work Settings Regulations Search Accountants Virtual Reality User Error Techology Unified Communications Wire Tools webinar Internet exploMicrosoft Best Practice HVAC Data Warehousing Multi-Factor Security Apple Loyalty How to Worker Commute Theft Sports IBM Trending Conferencing Rootkit Enterprise Content Management IoT iPhone Devices Wireless Cortana Smart Office Botnet Supercomputer Lifestyle Content Advertising Wireless Technology Password Management Fraud Thought Leadership Flash Shadow IT File Sharing Twitter WiFi Webinar Business Technology IT solutions Company Culture Telephone System Managing Stress Robot CrashOverride