Have we been creating passwords the wrong way all along? You might think so, based on the new set of guidelines the National Institute of Standards and Technology (NIST) recently issued about the best password practices.

NIST Special Publication 800-63 is a comprehensive guide to managing digital identity, and its recommendations are widely adopted by organizations of all kinds. The most recent guidelines, which were issued in June, modify a 14-year-old sets of rules for password selection — some would say dramatically.

The original guidance, which was published in 2003, recommended the use of passwords composed of random strings of uppercase and lowercase text mixed with symbols. Passwords like “Q*!f7aRd^&23” thus became the holy grail of authentication. The new guidelines lean instead toward the use of long passwords composed of unrelated words, such as “dogbarnheliumsynchronousbudget.” Such passwords are easier to remember and just as hard to crack as their gibberish counterparts, according to the NIST.

Password Practices Past Their Prime?

The Wall Street Journal recently asked the author of the 2003 guidelines about the changes. Bill Burr, a former NIST manager who has since retired, said he now regrets the advice he put forth 14 years ago, saying the rules were too complicated for people to follow.

But the problem wasn’t the advice — it was people. A careful reading of the new guidelines shows that the NIST’s recommendations on password practices haven’t changed all that much, but they have been expanded to encompass new options.

The original guidelines are based on a concept called password entropy, which is a mathematical equation that evaluates the difficulty of cracking a password. In a 2010 academic report, a team of researchers from Florida State University, Redjack and Cisco IronPort Systems discounted the entropy principle as basically useless where humans are involved. They mined through millions of passwords and determined that a mix of letters, numbers and punctuation chosen by a user are often easily guessed by an attacker using a cracking dictionary of just a few hundred thousand words.

Many websites adhere to the principles of randomness, but don’t supervise the results. People can’t remember “Q*!f7aRd^&23,” so they come up with variations that technically comply with the rules but are still easy to guess. For example, simple substitutions such as “$” for “s” and “@” for “a” lead to “[email protected]$$w0rd,” which, although technically acceptable, is still a terrible choice for a password.

Fixing the People Problem

The problem, then, has to do with the enforcement of the NIST guidance. The authors of the 2010 report concluded that people are going to opt for passwords that are easy to remember, no matter what the rules are. Easy-to-remember passwords are also easy to guess. The advantage of long strings of common words over random letters and characters is that they are somewhat easier to remember — that is, if you can call “dogbarnheliumsynchronousbudget” easy.

The authors scolded website operators for making it too easy for users to select passwords that technically comply with rules but aren’t secure. They recommended that password selection be an interactive process in which the authentication engine on the website suggests secure alternatives to the choices users make. Entropy could have value in that scenario, as long as algorithms are involved.

A good solution is to use a password manager, which generates suggested passwords using truly random combinations of letters, numbers and characters, and stores them so users never have to memorize or write them down. There are plenty of free or inexpensive choices out there that are well worth the modest investment.

Listen to the podcast: ‘Cracken’ Passwords with EvilMog of IBM X-Force Red

More from Endpoint

Deploying Security Automation to Your Endpoints

Globally, data is growing at an exponential rate. Due to factors like information explosion and the rising interconnectivity of endpoints, data growth will only become a more pressing issue. This enormous influx of data will invariably affect security teams. Faced with an enormous amount of data to sift through, analysts are feeling the crunch. Subsequently, alert fatigue is already a problem for analysts overwhelmed with security tasks. With the continued shortage of qualified staff, organizations are looking for automation to…

Threat Management and Unified Endpoint Management

The worst of the pandemic may be behind us, but we continue to be impacted by it. School-aged kids are trying to catch up academically and socially after two years of disruption. Air travel is a mess. And all businesses have seen a spike in cyberattacks. Cyber threats increased by 81% while COVID-19 was at its peak, with 79% of all organizations experiencing a loss of business operations during that time. The risk of cyberattacks increased so much that the…

3 Ways EDR Can Stop Ransomware Attacks

Ransomware attacks are on the rise. While these activities are low-risk and high-reward for criminal groups, their consequences can devastate their target organizations. According to the 2022 Cost of a Data Breach report, the average cost of a ransomware attack is $4.54 million, without including the cost of the ransom itself. Ransomware breaches also took 49 days longer than the data breach average to identify and contain. Worse, criminals will often target the victim again, even after the ransom is…

How EDR Security Supports Defenders in a Data Breach

The cost of a data breach has reached an all-time high. It averaged $4.35 million in 2022, according to the newly published IBM Cost of a Data Breach Report. What’s more, 83% of organizations have faced more than one data breach, with just 17% saying this was their first data breach. What can organizations do about this? One solution is endpoint detection and response (EDR) software. Take a look at how an effective EDR solution can help your security teams. …