We all use too many passwords, and many of us reuse the same password on numerous sites, which is bad for both individual and corporate security. While many IT managers have tried to fix this over the years, the situation is only getting worse as more cloud-based logins are used, making more passwords necessary. Users need ways to improve password strength and make the codes more effective.

Britain Strives for Better Protection

Britain’s Government Communications Headquarters (GCHQ), the equivalent agency of the U.S. National Security Agency (NSA), recently created a document titled “Password Guidance: Simplifying Your Approach,” which offers surprisingly sound and cogent advice. It advocates a dramatic simplification of the current approach at a system level rather than asking users to recall unnecessarily complicated passwords.

The GCHQ isn’t the first agency to produce such a document, but it does have a great deal of common sense appeal — on purpose. Its goal is to try to get ordinary users to do a better job with password creation in the interest of providing better security for systems. Other efforts have focused more on security administrators, such as this TechNet article aimed at Windows Server environments and this lengthy discussion forum on Spiceworks that debates various ideas about strengthening password policies. There is even an older article on Dark Reading that covers some of the basics, showing just how long this issue has been debated.

But the GCHQ document is notable in how it goes about making suggestions for improving password strength. Some things they recommend not doing include frequently changing passwords globally across a corporation. This “carries no real benefits as stolen passwords are generally exploited immediately” — good point. So much for those password strength indicators that are often applied.

Also, the organization takes issue with requiring very complex passwords with odd characters and obscene lengths, claiming that those don’t really work, either. “Traditionally, organizations impose rules on the length and complexity of passwords. However, people then tend to use predictable strategies to generate passwords, so the security benefit is marginal while the user burden is high.”

Strategies for Better Password Strength

So what are the best ways to boost passwords? Here are seven strategies that the GCHQ does recommend:

  1. Change default passwords immediately.
  2. Use password management software tools.
  3. Blacklist commonly chosen passwords.
  4. Choose machine-generated passwords that are easier to remember, such as four random words strung together.
  5. Pay more attention to administrator accounts and other privileged user access, including using two-factor methods to protect them.
  6. Use account lockout and protective monitoring to ensure exploits are quickly detected.
  7. Don’t store passwords anywhere as plaintext.

The document is a quick read and well worth reviewing. It may even inspire some organizations to revamp their password protection policies in search of better security practices.

More from Application Security

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

Vulnerability management, its impact and threat modeling methodologies

7 min read - Vulnerability management is a security practice designed to avoid events that could potentially harm an organization. It is a regular ongoing process that identifies, assesses, and manages vulnerabilities across all the components of an IT ecosystem. Cybersecurity is one of the major priorities many organizations struggle to stay on top of. There is a huge increase in the number of cyberattacks carried out by cybercriminals to steal valuable information from businesses. Hence to encounter these attacks, organizations are now focusing…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Unmasking hypnotized AI: The hidden risks of large language models

11 min read - The emergence of Large Language Models (LLMs) is redefining how cybersecurity teams and cybercriminals operate. As security teams leverage the capabilities of generative AI to bring more simplicity and speed into their operations, it's important we recognize that cybercriminals are seeking the same benefits. LLMs are a new type of attack surface poised to make certain types of attacks easier, more cost-effective, and even more persistent. In a bid to explore security risks posed by these innovations, we attempted to…