{"id":2886,"date":"2022-04-01T12:34:00","date_gmt":"2022-04-01T12:34:00","guid":{"rendered":"https:\/\/sectigostore.com\/blog\/?p=2886"},"modified":"2022-03-24T22:34:51","modified_gmt":"2022-03-24T22:34:51","slug":"12-password-policy-best-practices-to-adopt-today","status":"publish","type":"post","link":"https:\/\/sectigostore.com\/blog\/12-password-policy-best-practices-to-adopt-today\/","title":{"rendered":"12 Password Policy Best Practices to Adopt Today"},"content":{"rendered":"\n

Verizon\u2019s 2021 DBIR<\/a>  revealed that credentials were the most sought-after type of data in breaches. Credentials were stolen in 60% of breaches \u2014 more than medical, bank, or payment information. So, what password policy best practices can we adopt today to secure our accounts?<\/h2>\n\n\n\n

According to Verizon\u2019s 2021 Data Breach Investigations Report (DBIR), 85% of social engineering attacks were launched to steal credentials. Using unique passwords is how we lock our accounts and devices to protect them from unauthorized users. Passwords are the first line of defense against unauthorized users and have to be impeccable. But having strong password security goes beyond just having strong passwords \u2014 it also requires having a useful and practice password policy in place as well.<\/p>\n\n\n\n

If you\u2019re looking to implement a password policy in your business, here are our top 12 password policy best practices to put into action away.<\/p>\n\n\n\n

What Makes a Good Password Policy?<\/h2>\n\n\n\n
\"Password
Passwords should be memorized secrets that are easy to remember but hard for attackers to brute force.<\/figcaption><\/figure>\n\n\n\n

A password policy is a set of rules for an organization to create, store, use and secure strong passwords to ensure a secure network. If you want to set up a strong password policy, it\u2019s crucial to find the perfect balance between security and convenience for the end user. If the policy is too difficult to follow, your employees might not follow it properly. On the other hand, if it is too lax, security will be compromised. To be effective, the policy has to be like Goldilocks\u2019s porridge: \u201cjust right.\u201d<\/p>\n\n\n\n

You should think about the nature of your business and the level at which you work when developing your policies. If your website shares free recipes about baked goods, you might not need the same stringent policies as, say, an arms manufacturer. A security professional’s unbiased review of your organization will go a long way in setting up your password policies.<\/p>\n\n\n\n

The National Institute of Standards and Technology (NIST) has some great information available in their Authentication and Lifecycle Management Guidelines<\/a> (SP 600-63B).<\/p>\n\n\n\n

Password Policy Best Practices<\/h2>\n\n\n\n

Now, let\u2019s look at 12 password policy best practices that can strengthen your organization\u2019s account security defenses.<\/p>\n\n\n\n

1.\u00a0When It Comes to Passwords, the Longer the Better<\/h3>\n\n\n\n

An organization should specify the minimum length of passwords for all users. Shorter passwords are susceptible to brute force attacks<\/a>, which are attacks involving an attacker trying to repeatedly guess your username-password combination. Longer passwords take more time to crack by brute force attack because they require an attacker to try out a higher number of potential combinations.<\/p>\n\n\n\n

The following table shows how long it takes to crack passwords of various lengths, as determined by Hive Systems<\/a>. It clearly shows the importance of using longer passwords:<\/p>\n\n\n\n

No. of letters used<\/td>Whether numbers are used<\/td>Mix of uppercase and lowercase letters are used<\/td>Whether special characters are used<\/td>Time taken to crack the password<\/td><\/tr>
8<\/td>No<\/td>Yes<\/td>No<\/td>2 minutes<\/td><\/tr>
8<\/td>Yes<\/td>Yes<\/td>No<\/td>7 minutes<\/td><\/tr>
8<\/td>Yes<\/td>Yes<\/td>Yes<\/td>39 minutes<\/td><\/tr>
12<\/td>No<\/td>Yes<\/td>No<\/td>24 years<\/td><\/tr>
12<\/td>Yes<\/td>Yes<\/td>No<\/td>200 years<\/td><\/tr>
12<\/td>Yes<\/td>Yes<\/td>Yes<\/td>3,000 years<\/td><\/tr>
16<\/td>No<\/td>Yes<\/td>No<\/td>173 million years<\/td><\/tr>
16<\/td>Yes<\/td>Yes<\/td>No<\/td>3 billion years<\/td><\/tr>
16<\/td>Yes<\/td>Yes<\/td>Yes<\/td>92 billion years<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

While forming your password policy, bear in mind that longer passwords are harder to remember, so employees might be tempted to write them down. This could lead to unauthorized people gaining access. So, try to balance the number of characters required for the passwords with the difficulty of remembering them.<\/p>\n\n\n\n

The Federal Bureau of Intelligence (FBI)<\/a> recommends using strong passphrases in place of passwords to make them easier to remember. For example, a passphrase like Istartedriding@6<\/em> is easier to remember than a random jumble of letters, numbers and characters like dg8GY%ire&cSIirn#<\/em>. You can always switch letters with symbols and numbers to make a passphrase harder to brute force like i$tart3Drid1ng@6<\/em>.<\/p>\n\n\n\n

2.\u00a0Pay Attention to Password Content<\/h3>\n\n\n\n

The above table also shows that when you mix special characters and numbers in passwords, it takes much longer for the criminals to crack them. So, using different types of characters is a smart choice.<\/p>\n\n\n\n