You make password decisions every week. Maybe you create a new account, reset a password or respond to a password change prompt. And each time you make a seemingly small or insignificant mistake in regard to password safety, such as not creating strong enough passwords or using the same password on multiple accounts, you increase your risk.

There are a lot of articles you can read about password safety, and it can be confusing to know who to listen to and what to follow. So we decided to turn to the trusted source for password security: the National Institute of Standards and Technology (NIST) Special Publication 800-63B. The document contains many (many) pages of technical details and lots of government jargon, which makes it hard to read.

What NIST Says About Password Safety

So, we deciphered all the tips for you. Here are five simple actions you should take, both at home and work, to keep your data and network safe. Along with many other tips and guidelines from NIST, these are the most common mistakes and most surprising suggestions.

Don’t select passwords an attacker can easily guess. While this one is a no-brainer, it’s one of the most common mistakes. You can improve your password safety by not using a dictionary word, a password cracked in a previous breach, repetitive characters or a password that is part of your username or the application/service.

The NIST recommends that employers maintain a list of easy-to-guess words that include these types of passwords. From there, they can verify that all passwords are not on the list. Surprisingly, NIST also recommends against checking whether a password meets certain composition requirements beyond being six characters. For example, you may be familiar with systems that ask for special characters or numbers.

Use a password strength meter. The NIST recommends against requiring more than six characters. Instead, it suggests companies use a password strength meter to tell users if their password is strong or weak. Even though it’s not required, most people don’t want to let the strength meter down by using a password in the yellow or red range. Counter to common usage, NIST says organizations shouldn’t require employees to change passwords at specific intervals, such as every month or quarter. Lastly, they recommend only prompting employees to change passwords when the password is compromised or suspected to be compromised.

Use biometrics only in combination with physical authentication. Biometrics are not foolproof. So, you should only use them as one part of two-factor authentication. The second authenticator should be something the person possesses, such as a device. The NIST also recommends that the password safety system should only ask for biometrics after the person has used one method of authentication. That way, the server has proved it is at least partially secure.

Log out of all accounts at least every 30 days. I know I can’t be the only one who possibly hasn’t logged out of some accounts for years. But staying logged in all the time increases the risk of someone being able to steal the password. In addition, businesses should enforce this policy by automatically logging employees out of work-related accounts every 30 days. This requires everyone to prove they are who they say they are once a month. If someone has broken into an account, this requirement limits the damage to shorter time periods.

Use multifactor authentication (MFA). While this is a common recommendation for password safety, the NIST repeats this advice throughout the publication. The statement “multiple factors make successful attacks more difficult to accomplish” really sums up why they recommend MFA. MFA not only makes it harder for an attack to be successful, many threat actors won’t even try to get past the barrier because the success rate is too low for the time needed to crack it. By adding MFA to their systems, especially for actions like changing passwords or accessing work-related networks and sites through a new device, businesses can really improve their security.

A Safe Password Makes for Safe Data

For businesses, every employee multiplies password safety risk. By stealing one credential from a single, poor password decision by an employee, a threat actor can damage an entire organization’s finances and reputation. Yes, it’s really that easy to cause major damage. Not practicing good password hygiene at home can cause similar damage to personal devices and data.

The NIST 800-63B certainly isn’t light reading, but its suggestions are solid. By following these five tips, you can improve both your personal and business password safety.

More from Fraud Protection

What’s up India? PixPirate is back and spreading via WhatsApp

8 min read - Quick recapThis blog post is the continuation of a previous blog regarding PixPirate malware. If you haven’t read the initial post, please take a couple of minutes to get caught up before diving into this additional content. As a reminder, PixPirate malware consists of two components: a downloader application and a droppee application, and both are custom-made and operated by the same fraudster group. Although the traditional role of a downloader is to install the droppee on the victim device,…

Unveiling the latest banking trojan threats in LATAM

9 min read - This post was made possible through the research contributions of Amir Gendler.In our most recent research in the Latin American (LATAM) region, we at IBM Security Lab have observed a surge in campaigns linked with malicious Chrome extensions. These campaigns primarily target Latin America, with a particular emphasis on its financial institutions.In this blog post, we’ll shed light on the group responsible for disseminating this campaign. We’ll delve into the method of web injects and Man in the Browser, and…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today