You make password decisions every week. Maybe you create a new account, reset a password or respond to a password change prompt. And each time you make a seemingly small or insignificant mistake in regard to password safety, such as not creating strong enough passwords or using the same password on multiple accounts, you increase your risk.

There are a lot of articles you can read about password safety, and it can be confusing to know who to listen to and what to follow. So we decided to turn to the trusted source for password security: the National Institute of Standards and Technology (NIST) Special Publication 800-63B. The document contains many (many) pages of technical details and lots of government jargon, which makes it hard to read.

What NIST Says About Password Safety

So, we deciphered all the tips for you. Here are five simple actions you should take, both at home and work, to keep your data and network safe. Along with many other tips and guidelines from NIST, these are the most common mistakes and most surprising suggestions.

Don’t select passwords an attacker can easily guess. While this one is a no-brainer, it’s one of the most common mistakes. You can improve your password safety by not using a dictionary word, a password cracked in a previous breach, repetitive characters or a password that is part of your username or the application/service.

The NIST recommends that employers maintain a list of easy-to-guess words that include these types of passwords. From there, they can verify that all passwords are not on the list. Surprisingly, NIST also recommends against checking whether a password meets certain composition requirements beyond being six characters. For example, you may be familiar with systems that ask for special characters or numbers.

Use a password strength meter. The NIST recommends against requiring more than six characters. Instead, it suggests companies use a password strength meter to tell users if their password is strong or weak. Even though it’s not required, most people don’t want to let the strength meter down by using a password in the yellow or red range. Counter to common usage, NIST says organizations shouldn’t require employees to change passwords at specific intervals, such as every month or quarter. Lastly, they recommend only prompting employees to change passwords when the password is compromised or suspected to be compromised.

Use biometrics only in combination with physical authentication. Biometrics are not foolproof. So, you should only use them as one part of two-factor authentication. The second authenticator should be something the person possesses, such as a device. The NIST also recommends that the password safety system should only ask for biometrics after the person has used one method of authentication. That way, the server has proved it is at least partially secure.

Log out of all accounts at least every 30 days. I know I can’t be the only one who possibly hasn’t logged out of some accounts for years. But staying logged in all the time increases the risk of someone being able to steal the password. In addition, businesses should enforce this policy by automatically logging employees out of work-related accounts every 30 days. This requires everyone to prove they are who they say they are once a month. If someone has broken into an account, this requirement limits the damage to shorter time periods.

Use multifactor authentication (MFA). While this is a common recommendation for password safety, the NIST repeats this advice throughout the publication. The statement “multiple factors make successful attacks more difficult to accomplish” really sums up why they recommend MFA. MFA not only makes it harder for an attack to be successful, many threat actors won’t even try to get past the barrier because the success rate is too low for the time needed to crack it. By adding MFA to their systems, especially for actions like changing passwords or accessing work-related networks and sites through a new device, businesses can really improve their security.

A Safe Password Makes for Safe Data

For businesses, every employee multiplies password safety risk. By stealing one credential from a single, poor password decision by an employee, a threat actor can damage an entire organization’s finances and reputation. Yes, it’s really that easy to cause major damage. Not practicing good password hygiene at home can cause similar damage to personal devices and data.

The NIST 800-63B certainly isn’t light reading, but its suggestions are solid. By following these five tips, you can improve both your personal and business password safety.

More from Fraud Protection

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

How Security Teams Combat Disinformation and Misinformation

“A lie can travel halfway around the world while the truth is still putting on its shoes.” That popular quote is often attributed to Mark Twain. But since we're talking about misinformation and disinformation, you’ll be unsurprised to learn Twain never said that at all. In fact, no one knows who first strung those words together, but the idea that truth spreads slowly while lies spread quickly is at least several hundred years old. The “Twain” quote also serves to…

A View Into Web(View) Attacks in Android

James Kilner contributed to the technical editing of this blog. Nethanella Messer, Segev Fogel, Or Ben Nun and Liran Tiebloom contributed to the blog. Although in the PC realm it is common to see financial malware used in web attacks to commit fraud, in Android-based financial malware this is a new trend. Traditionally, financial malware in Android uses overlay techniques to steal victims’ credentials. In 2022, IBM Security Trusteer researchers discovered a new trend in financial mobile malware that targets…

New DOJ Team Focuses on Ransomware and Cryptocurrency Crime

While no security officer would rely on this alone, it’s good to know the U.S. Department of Justice is increasing efforts to fight cyber crime. According to a recent address in Munich by Deputy Attorney General Lisa Monaco, new efforts will focus on ransomware and cryptocurrency incidents. This makes sense since the X-Force Threat Intelligence Index 2022 named ransomware as the top attack type in 2021. What exactly is the DOJ doing to improve policing of cryptocurrency and other cyber…