We all use too many passwords, and many of us reuse the same password on numerous sites, which is bad for both individual and corporate security. While many IT managers have tried to fix this over the years, the situation is only getting worse as more cloud-based logins are used, making more passwords necessary. Users need ways to improve password strength and make the codes more effective.
Britain Strives for Better Protection
Britain’s Government Communications Headquarters (GCHQ), the equivalent agency of the U.S. National Security Agency (NSA), recently created a document titled “Password Guidance: Simplifying Your Approach,” which offers surprisingly sound and cogent advice. It advocates a dramatic simplification of the current approach at a system level rather than asking users to recall unnecessarily complicated passwords.
The GCHQ isn’t the first agency to produce such a document, but it does have a great deal of common sense appeal — on purpose. Its goal is to try to get ordinary users to do a better job with password creation in the interest of providing better security for systems. Other efforts have focused more on security administrators, such as this TechNet article aimed at Windows Server environments and this lengthy discussion forum on Spiceworks that debates various ideas about strengthening password policies. There is even an older article on Dark Reading that covers some of the basics, showing just how long this issue has been debated.
But the GCHQ document is notable in how it goes about making suggestions for improving password strength. Some things they recommend not doing include frequently changing passwords globally across a corporation. This “carries no real benefits as stolen passwords are generally exploited immediately” — good point. So much for those password strength indicators that are often applied.
Also, the organization takes issue with requiring very complex passwords with odd characters and obscene lengths, claiming that those don’t really work, either. “Traditionally, organizations impose rules on the length and complexity of passwords. However, people then tend to use predictable strategies to generate passwords, so the security benefit is marginal while the user burden is high.”
Strategies for Better Password Strength
So what are the best ways to boost passwords? Here are seven strategies that the GCHQ does recommend:
- Change default passwords immediately.
- Use password management software tools.
- Blacklist commonly chosen passwords.
- Choose machine-generated passwords that are easier to remember, such as four random words strung together.
- Pay more attention to administrator accounts and other privileged user access, including using two-factor methods to protect them.
- Use account lockout and protective monitoring to ensure exploits are quickly detected.
- Don’t store passwords anywhere as plaintext.
The document is a quick read and well worth reviewing. It may even inspire some organizations to revamp their password protection policies in search of better security practices.