A password policy designed for federal agencies must be secure, right? Surprisingly, that hasn’t been the case, according to the National Institute of Standards and Technology (NIST). The NIST created many of the password best practices you probably loathe — the combination of letters, numbers, and special characters — but it now says those guidelines were misguided and has changed its stance on the matter. Find out why and how it involves you.
The problem
The issue isn’t necessarily that the NIST advised people to create passwords that are easy to crack, but it steered people into creating lazy passwords, using capitalization, special characters, and numbers that are easy to predict, like “P@ssW0rd1.”
This may seem secure, but in reality, these strings of characters and numbers could easily be compromised by hackers using common algorithms.
To make matters worse, NIST also recommended that people change their passwords regularly, but did not define what it actually means to “change” them. Since people thought their passwords were already secure with special characters, most only added one number or symbol.
NIST essentially forced everyone to use passwords that are hard for humans to remember but easy for computers to guess.
Recently, the institution admitted that this scheme can cause more problems than solutions. It has reversed its stance on organizational password management requirements, and is now recommending banishing forced periodic password changes and getting rid of complexity requirements.
The solution
Security consultant Frank Abagnale and Chief hacking officer for KnowBe4 Kevin Mitnick both see a future without passwords. Both security experts advise enterprises to utilize multifactor authentication (MFA) in login policies.
This requires users to present two valid credentials to gain access to their data. For instance, a code texted to an employee’s smartphone can serve as an added security measure to thwart hackers.
Moreover, Mitnick recommended implementing long passphrases of 25 characters or more, such as “correcthorsebatterystaple” or “iknewweretroublewhenwalkedin5623”. These are much more difficult to guess and less prone to hacking. As for the frequency of changing passphrases, it will depend on a company’s risk tolerance.
Simply put, passwords should be longer and include nonsensical phrases and English words that make it almost impossible for an automated system to make sense of.
Even better, you should enforce the following security solutions within your company:
- Single sign-on – allows users to securely access multiple accounts with one set of credentials
- Account monitoring tools – recognizes suspicious activity and locks out hackers
When it comes to security, ignorance is the biggest threat. If you’d like to learn about what else you can do, just give us a call.
Password security: South Florida Business Takeaways
Password security is important for South Florida businesses that rely on secure systems, dependable cloud tools, responsive support, and practical IT planning. Nextek IT helps local teams make Password security part of a managed technology standard instead of a one-time fix.
Cloud communication and productivity tools perform better when access, backup, cybersecurity, and support are managed together. For growing companies, that means documenting settings, reviewing user access, checking backups, and giving employees a clear support path.
- Review how Password security affects users, devices, cloud apps, and security controls.
- Confirm policies, backups, and support steps before a small issue becomes downtime.
- Schedule recurring technology reviews so improvements stay current as the business changes.
For help with Password security, explore Nextek IT’s fully managed IT services, server and desktop support, and cybersecurity services.
Contact Nextek IT when your South Florida team wants Password security handled by a responsive IT support partner.