Full-Service Law Firm solving complex challenges through bold thinking, precise execution, and shared purpose.

Full Service Law Firm | Michael Best & Friedrich LLP

Specializing in the Intersection of Business &amp; Government

Meet our team of trusted advisors, strategic thinkers, and community builders dedicated to client success.

Learn about our full-service legal and business solutions, designed to address complex challenges for leading organizations across industries.

Access thought leadership, news, and resources to stay informed about the latest trends, legal developments, and industry innovations.

Discover how partnership, bold thinking, and precise execution drive results for clients nationwide.

Explore how our national reach and local expertise support clients across the United States and beyond.

Grow at a firm designed to bring out your best.

Cybersecurity is a growing concern, but for many years security practices have ignored the realities of human behavior. While strict password rules aim to enhance security, they can frustrate people, leading them to adopt practices that actually weaken security. For example, the requirement to periodically change passwords can actually diminish security because the added burden incentivizes weaker passwords that are easier for people to set and remember. Solving that problem by enforcing complex passwords leads to people writing passwords down rather than memorizing them.If the goal is actual security, it is important to work with and not against people. Recognizing this, the <a href="https://www.nist.gov/">National Institute of Standards and Technology (NIST)</a> recently updated its guidelines for password security. The updates are a significant but welcome shift from traditional practices.Understanding the Need for Updated GuidelinesPhysical passkeys, digital IDs, and other authentication modes may ultimately replace passwords, but for now passwords remain a critical component of cybersecurity. They serve as the first line of defense for individuals and organizations. Breached passwords continue to be one of the most common cybersecurity threats. By understanding the threats to authentication identified by NIST, organizations can better define and respond to security risks.Some Key UpdatesThe guidelines include more forceful recommendations than in the past, as indicated by “SHALL” and “SHALL NOT” practices, which must be followed in order to comply with the standard. Some practices are still phrased in the form of “SHOULD” and “SHOULD NOT,” which form recommended though not required best practices.<ul><li>Password length has been addressed: the minimum length SHALL be 8 characters (up from 6) and passwords of up to 64 characters SHOULD be allowed. This ensures that users wishing to use longer pass phrase style passwords may do so.</li><li>Composition rules (e.g., requiring mixtures of different character types) SHALL NOT be enforced and Unicode (ISO/ISC 10646) characters SHOULD be accepted in passwords.</li><li>Password changes SHALL only be forced where there is evidence of compromise.</li><li>Password hints SHALL NOT be allowed (if accessible to the unauthenticated user).</li><li>Knowledge-based security questions (e.g., “What is your mother's maiden name?”) SHALL NOT be used. This eliminates a major threat vector used by social engineering attacks.</li><li>Verifiers SHALL verify the entire submitted password (i.e., not truncate it).</li></ul>These are all welcome changes that will encourage the use of more secure passwords.ConclusionWhile the NIST standards do not have the force of law, they provide a solid set of best practices that businesses can use as a starting point for securing their data and the data under their care.For more detailed insights into NIST's password guidelines, you can refer to the <a href="https://pages.nist.gov/800-63-3/sp800-63b.html">NIST Special Publication 800-63B</a>.<input type='hidden' id='passle-remote-hosting-tracking-shortcode' value='102jltz'/><blockquote class="wp-block-quote passle-quote has-cite-link">The rapid proliferation of online services over the past few years has heightened the need for reliable, equitable, secure, and privacy-protective digital identity solutions.<cite><a href="https://pages.nist.gov/800-63-4/" aria-label="pages.nist.gov/..." title="https://pages.nist.gov/800-63-4/" target="_blank">pages.nist.gov/...</a></cite></blockquote><div class="passle-featured-image passle-featured-image-position-bottom"><img src="https://images.passle.net/fit-in/400x400/filters:crop(38,0,2180,1227)/Passle/5f6edd8e8cb62a0bec3e5fd2/SearchServiceImages/2024-10-15-15-55-31-006-670e9073db08507d03de9163.jpg" alt="Featured Image" /></div>

NIST Proposes Updated Password Practices

Related People

You may also be interested in these

International Trademark Portfolios: When Does It Make Sense to Let a Registration Go?

Michael Best, New York-based Kane Kessler, P.C. Complete Strategic Combination

Platform Leakage: How Manufacturing Contracts Get It Wrong

Related People

You may also be interested in these

International Trademark Portfolios: When Does It Make Sense to Let a Registration Go?

Michael Best, New York-based Kane Kessler, P.C. Complete Strategic Combination

Platform Leakage: How Manufacturing Contracts Get It Wrong

Slide Menu

Slide Search