You make password decisions every week. Maybe you create a new account, reset a password or respond to a password change prompt. And each time you make a seemingly small or insignificant mistake in regard to password safety, such as not creating strong enough passwords or using the same password on multiple accounts, you increase your risk.

There are a lot of articles you can read about password safety, and it can be confusing to know who to listen to and what to follow. So we decided to turn to the trusted source for password security: the National Institute of Standards and Technology (NIST) Special Publication 800-63B. The document contains many (many) pages of technical details and lots of government jargon, which makes it hard to read.

What NIST Says About Password Safety

So, we deciphered all the tips for you. Here are five simple actions you should take, both at home and work, to keep your data and network safe. Along with many other tips and guidelines from NIST, these are the most common mistakes and most surprising suggestions.

Don’t select passwords an attacker can easily guess. While this one is a no-brainer, it’s one of the most common mistakes. You can improve your password safety by not using a dictionary word, a password cracked in a previous breach, repetitive characters or a password that is part of your username or the application/service.

The NIST recommends that employers maintain a list of easy-to-guess words that include these types of passwords. From there, they can verify that all passwords are not on the list. Surprisingly, NIST also recommends against checking whether a password meets certain composition requirements beyond being six characters. For example, you may be familiar with systems that ask for special characters or numbers.

Use a password strength meter. The NIST recommends against requiring more than six characters. Instead, it suggests companies use a password strength meter to tell users if their password is strong or weak. Even though it’s not required, most people don’t want to let the strength meter down by using a password in the yellow or red range. Counter to common usage, NIST says organizations shouldn’t require employees to change passwords at specific intervals, such as every month or quarter. Lastly, they recommend only prompting employees to change passwords when the password is compromised or suspected to be compromised.

Use biometrics only in combination with physical authentication. Biometrics are not foolproof. So, you should only use them as one part of two-factor authentication. The second authenticator should be something the person possesses, such as a device. The NIST also recommends that the password safety system should only ask for biometrics after the person has used one method of authentication. That way, the server has proved it is at least partially secure.

Log out of all accounts at least every 30 days. I know I can’t be the only one who possibly hasn’t logged out of some accounts for years. But staying logged in all the time increases the risk of someone being able to steal the password. In addition, businesses should enforce this policy by automatically logging employees out of work-related accounts every 30 days. This requires everyone to prove they are who they say they are once a month. If someone has broken into an account, this requirement limits the damage to shorter time periods.

Use multifactor authentication (MFA). While this is a common recommendation for password safety, the NIST repeats this advice throughout the publication. The statement “multiple factors make successful attacks more difficult to accomplish” really sums up why they recommend MFA. MFA not only makes it harder for an attack to be successful, many threat actors won’t even try to get past the barrier because the success rate is too low for the time needed to crack it. By adding MFA to their systems, especially for actions like changing passwords or accessing work-related networks and sites through a new device, businesses can really improve their security.

A Safe Password Makes for Safe Data

For businesses, every employee multiplies password safety risk. By stealing one credential from a single, poor password decision by an employee, a threat actor can damage an entire organization’s finances and reputation. Yes, it’s really that easy to cause major damage. Not practicing good password hygiene at home can cause similar damage to personal devices and data.

The NIST 800-63B certainly isn’t light reading, but its suggestions are solid. By following these five tips, you can improve both your personal and business password safety.

More from Fraud Protection

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today