Do you know whether your employees are using strong passwords? Are they adhering to password security best practices? And is your IT team implementing best practices for strong password storage and security? In this article, we\u2019ll cover what experts identify as characteristics of a strong password. We\u2019ll also go over a list of 10 password security tips you can implement right away to help better secure your organization.<\/p>\n\n\n\n
Breaking Down Password Security Basics: What\u2019s a Strong Password?<\/h2>\n\n\n\n![\"strong](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2016\/07\/strong-password.jpg\")
A password security graphic that’s a screen of a password being entered into a login form.<\/figcaption><\/figure><\/div>\n\n\n\nWhat one person considers a strong password is often very different from what actually qualifies as such. And, frankly, password recommendations have changed over time. For example, the FBI says<\/a> that it\u2019s better to use a strong and long passphrase<\/em> instead of a traditional password. They describe a passphrase as a combination of words that\u2019s greater than 15 characters in length.<\/p>\n\n\n\nBut why is having a longer password (or, moreover, passphrase) better in terms of account security? The National Institute of Standards and Technology (NIST)<\/a> describes password length as defining factor of password strength and security in their Digital Identity Guidelines (SP-800-63B). \u201cPasswords that are too short yield to brute force attacks as well as to dictionary attacks using words and commonly chosen passwords.\u201d<\/p>\n\n\n\nHowever, there are a few key traits or qualities that help you form a strong password (or, more accurately, passphrase):<\/p>\n\n\n\n
- Uniqueness.<\/strong> Every account should use a unique password. This means users should never reuse or recycle passwords on accounts or, worse, across multiple accounts. This approach of having a unique password for every account helps to prevent a compromised password from being used in password cracking methods like rainbow tables and brute force attacks.<\/li>
- Length. <\/strong>We\u2019ve already touched on this guidance from both NIST and the FBI. With this in mind, passwords\/passphrases should be at least 15 characters in length (going by the FBI\u2019s recommendation). However, it\u2019s best to encourage your employees to use longer passwords.<\/li>
- Difficulty.<\/strong> A password should be something that\u2019s hard for someone else to try to guess but easy for you to remember. Even if it uses some common words, a cybercriminal still has to get them in the right order, and with the proper capitalizations, to use them in dictionary attacks.<\/li><\/ul>\n\n\n\n
But using strong passwords isn\u2019t just a good password security best practice \u2014 it\u2019s also critical to your organization\u2019s compliance. Regulations like the Payment Card Industry Data Security Standard (PCI DSS)<\/a>, European Union\u2019s General Data Protection Regulation (GDPR)<\/a>, and the Health Insurance Portability and Accountability Act (HIPAA)<\/a> require strong authentication or technical measures for access to help keep sensitive systems and data secure and protect user privacy.<\/p>\n\n\n\n10 Password Security Tips to Implement Within Your Organization<\/h2>\n\n\n\n
Unfortunately, poor password security practices are common. There are many factors that play into poor password security. It\u2019s not just about employees creating and using weak passwords. Some password security issues result from a lack of employee training, poor password policies, and even poor IT security and password storage practices.<\/p>\n\n\n\n
With this in mind, here are 10 password security tips that can help steer you in the right direction.<\/p>\n\n\n\n
1. Require Employees to Use Strong Passphrases Instead of Passwords <\/h3>\n\n\n\n
A traditional password contains uppercase and lowercase letters, numbers, special characters, and at least eight characters in length. By opting to use passphrases instead, you\u2019re making longer and strong passwords that are easier to remember. This can be part of a password policy that you have in place and enforce regularly.<\/p>\n\n\n\n
2. Educate Your Employees On Password Security<\/h3>\n\n\n\n
Don\u2019t leave your employees to flounder \u2014 provide them with specific guidance and examples of strong passwords. For example, if you tell them to add special characters or numbers to their passwords, know that they\u2019re likely just going to switch letters for common replacements, like \u201c3\u201d for \u201cE,\u201d \u201c@\u201d for \u201ca,\u201d or adding \u201c!\u201d to the beginning or end of their passwords. <\/p>\n\n\n\n
All of this information should be part of their cyber awareness training<\/a> and should be included in your organization\u2019s password policy. As a note, this type of training should also cover other areas of password security, such as credential phishing methods, and provide other useful password security tips. <\/p>\n\n\n\n3. Only Store Salted Password Hashes<\/h3>\n\n\n\n
A critical requirement of strong organizational password security is only to store password hash values. The NIST standard we mentioned earlier says that you should never store the passwords themselves and that you must use secure storage methods that are resistant to offline attacks. Hashing and salting (more on the latter in a moment) your passwords is one way to do this.<\/p>\n\n\n\n
A hash<\/strong> is a one-way mathematical function (i.e., a hashing algorithm<\/a>). So, when you hash a password, you\u2019re generating a unique cryptographic hash value that\u2019s too impractical and resource-intensive for anyone to reverse map. The downside of hashing passwords on their own is that if you hash the passwords of two users who use the exact same password (input), it\u2019ll generate the same password hash value (output).<\/p>\n\n\n\nLet\u2019s consider an example to explain this a little more clearly. Say two of your employees, users 1 and 2, are using the same password \u201cB0ringP@ssword.\u201d When you hash the password (in this example, we\u2019ll use the MD5 hash), both user 1 and user 2 will have the same hash digest \u201c46ab95fa1d5e5894ff780359d23a1067.\u201d<\/p>\n\n\n\n
This is an issue because cybercriminals can use that information to map or match password hashes to those they keep on file from data breaches. To prevent this from happening and to make those password hashes more complex and secure, you\u2019ll want to add a unique salt to each password first. <\/p>\n\n\n\n
A salt<\/a> <\/strong>is a unique, random number. By salting the password before hashing it, you\u2019re making it so that the password hash values that generate are unique \u2014 even if two employees use the exact same password.<\/p>\n\n\n\nNow, let\u2019s see what happens when we apply unique salt values to the same B0ringP@ssword example. If we add “Salt1” to user 1\u2019s password and “Salt2” to user 2\u2019s password before hashing them, you\u2019ll get two entirely different (unique) hash values:<\/p>\n\n\n\n
- User 1\u2019s input of “B0ringP@sswordSalt1” becomes the password hash value 94d1d9a4d4ab0553a6ebae030076309d<\/strong>.<\/li>
- User 2\u2019s input of “B0ringP@sswordSalt2” becomes the password hash value 461fa688da15c267951979eeeeb2acbf<\/strong>.<\/li><\/ul>\n\n\n\n
So, as you can see in the example above, even though both users use the same password, their hash values are unique because of the addition of a salt value in each case.<\/p>\n\n\n\n
4. Don\u2019t Require Periodic Password Changes<\/h3>\n\n\n\n
Although it\u2019s contradictory to traditional password security tips, NIST recommends that you stop requiring employees to change their passwords in SP-800-63B. Why? Because users are more likely to use weak passwords or reuse passwords across multiple accounts for the sake of convenience if you require them to do so frequently. Or, they may just add \u201c123\u201d or something similar to the end of their existing passwords. Again, this practice may be convenient but it doesn\u2019t make for more secure passwords.<\/p>\n\n\n\n
5. Allow Users to Copy and Paste Passwords Into Login Forms<\/h3>\n\n\n\n
NIST recommends allowing the copy-paste functionality for password fields because it encourages the use of password management tools and apps. Users can use password managers to generate and store complex passwords. Considering that NordPass reports the average user has upwards of 80 passwords<\/a>, it\u2019s no surprise that password managers are becoming increasingly popular with certain age groups.<\/p>\n\n\n\nHYPR\u2019s The State of Passwordless Authentication 2021 report<\/a> shares that 39% of Millennials and 24% of Generation Z adults use password management apps. That\u2019s because password managers offer convenience for individuals who want to use more complex passwords but don\u2019t want to have to remember all of them individually.<\/p>\n\n\n\n6. Disable Password Hints<\/h3>\n\n\n\n
Although password hints may seem like a great idea, they actually pose a significant risk to account and password security. As such, NIST guidelines specifically state that you shouldn\u2019t allow users to store hints that are viewable to unauthenticated users. Furthermore, they also speak out against using specific types of personal information for password security verifiers, such as \u201cwhat is your mother\u2019s maiden name?\u201d<\/p>\n\n\n\n
7. Develop a Password Blacklist to Compare User-Generated Passwords\/Passphrases Against<\/h3>\n\n\n\n
Integrate various lists into your password security system to force users to create more secure passwords. For example, you can create \u201cblacklists\u201d of passwords or passphrases that employees can\u2019t use. You can develop these lists using:<\/p>\n\n\n\n
- Lists of the common words<\/a> that you can find in the dictionary (and other interesting words<\/a>),<\/li>
- Lists of common passwords<\/a> (such as \u201cqwerty\u201d or \u201c1234567890\u201d), and<\/li>
- Repetitive or sequential characters or numbers (such as typing \u201c11111111\u201d or \u201cpoiuytr\u201d on your device\u2019s keyboard).<\/li><\/ul>\n\n\n\n
If a user tries to use one of these prohibited options, prevent the password creation process from moving forward until they enter a different password or passphrase.<\/p>\n\n\n\n
8. Make Breached Password Lists Another Password Security Bulwark<\/h3>\n\n\n\n
Much like the previous item on our list, you can use lists of known breached passwords as another password creation security measure. That\u2019s because breached password lists are easy to find online and make great resources for your organization. If any of the passwords users try to create match the ones on your lists, your system will automatically require them to enter a different value. <\/p>\n\n\n\n
You can find massive breached password lists<\/a> on the website haveibeenpwned.com<\/a>.<\/p>\n\n\n\n9. Require Users to Use a VPN When Connecting to Your Secure Resources<\/h3>\n\n\n\n
Most password security tips only focus on recommendations for creating strong passwords. But another important aspect of password security is ensuring that users are using secure connections when logging in to your internal sites, web apps, and other secure resources.<\/p>\n\n\n\n
A virtual private network (VPN) is a great option for employees who are working remotely. That\u2019s because a VPN allows users to enter their login credentials to connect and transmit data securely over the internet using encrypted connections. Without encryption, any data you transmit \u2014 including your usernames and passwords \u2014 bounces around the internet in an unsecure (i.e., readable) format. This plaintext data is something that cybercriminals and other bad guys can easily intercept, steal, modify or use without your permission.<\/p>\n\n\n\n
10. Get Rid of User Passwords Altogether<\/h3>\n\n\n\n
What one person considers a strong password is often very different from what actually qualifies as such. And, frankly, password recommendations have changed over time. For example, the FBI says<\/a> that it\u2019s better to use a strong and long passphrase<\/em> instead of a traditional password. They describe a passphrase as a combination of words that\u2019s greater than 15 characters in length.<\/p>\n\n\n\n But why is having a longer password (or, moreover, passphrase) better in terms of account security? The National Institute of Standards and Technology (NIST)<\/a> describes password length as defining factor of password strength and security in their Digital Identity Guidelines (SP-800-63B). \u201cPasswords that are too short yield to brute force attacks as well as to dictionary attacks using words and commonly chosen passwords.\u201d<\/p>\n\n\n\n However, there are a few key traits or qualities that help you form a strong password (or, more accurately, passphrase):<\/p>\n\n\n\n But using strong passwords isn\u2019t just a good password security best practice \u2014 it\u2019s also critical to your organization\u2019s compliance. Regulations like the Payment Card Industry Data Security Standard (PCI DSS)<\/a>, European Union\u2019s General Data Protection Regulation (GDPR)<\/a>, and the Health Insurance Portability and Accountability Act (HIPAA)<\/a> require strong authentication or technical measures for access to help keep sensitive systems and data secure and protect user privacy.<\/p>\n\n\n\n Unfortunately, poor password security practices are common. There are many factors that play into poor password security. It\u2019s not just about employees creating and using weak passwords. Some password security issues result from a lack of employee training, poor password policies, and even poor IT security and password storage practices.<\/p>\n\n\n\n With this in mind, here are 10 password security tips that can help steer you in the right direction.<\/p>\n\n\n\n A traditional password contains uppercase and lowercase letters, numbers, special characters, and at least eight characters in length. By opting to use passphrases instead, you\u2019re making longer and strong passwords that are easier to remember. This can be part of a password policy that you have in place and enforce regularly.<\/p>\n\n\n\n Don\u2019t leave your employees to flounder \u2014 provide them with specific guidance and examples of strong passwords. For example, if you tell them to add special characters or numbers to their passwords, know that they\u2019re likely just going to switch letters for common replacements, like \u201c3\u201d for \u201cE,\u201d \u201c@\u201d for \u201ca,\u201d or adding \u201c!\u201d to the beginning or end of their passwords. <\/p>\n\n\n\n All of this information should be part of their cyber awareness training<\/a> and should be included in your organization\u2019s password policy. As a note, this type of training should also cover other areas of password security, such as credential phishing methods, and provide other useful password security tips. <\/p>\n\n\n\n A critical requirement of strong organizational password security is only to store password hash values. The NIST standard we mentioned earlier says that you should never store the passwords themselves and that you must use secure storage methods that are resistant to offline attacks. Hashing and salting (more on the latter in a moment) your passwords is one way to do this.<\/p>\n\n\n\n A hash<\/strong> is a one-way mathematical function (i.e., a hashing algorithm<\/a>). So, when you hash a password, you\u2019re generating a unique cryptographic hash value that\u2019s too impractical and resource-intensive for anyone to reverse map. The downside of hashing passwords on their own is that if you hash the passwords of two users who use the exact same password (input), it\u2019ll generate the same password hash value (output).<\/p>\n\n\n\n Let\u2019s consider an example to explain this a little more clearly. Say two of your employees, users 1 and 2, are using the same password \u201cB0ringP@ssword.\u201d When you hash the password (in this example, we\u2019ll use the MD5 hash), both user 1 and user 2 will have the same hash digest \u201c46ab95fa1d5e5894ff780359d23a1067.\u201d<\/p>\n\n\n\n This is an issue because cybercriminals can use that information to map or match password hashes to those they keep on file from data breaches. To prevent this from happening and to make those password hashes more complex and secure, you\u2019ll want to add a unique salt to each password first. <\/p>\n\n\n\n A salt<\/a> <\/strong>is a unique, random number. By salting the password before hashing it, you\u2019re making it so that the password hash values that generate are unique \u2014 even if two employees use the exact same password.<\/p>\n\n\n\n Now, let\u2019s see what happens when we apply unique salt values to the same B0ringP@ssword example. If we add “Salt1” to user 1\u2019s password and “Salt2” to user 2\u2019s password before hashing them, you\u2019ll get two entirely different (unique) hash values:<\/p>\n\n\n\n So, as you can see in the example above, even though both users use the same password, their hash values are unique because of the addition of a salt value in each case.<\/p>\n\n\n\n Although it\u2019s contradictory to traditional password security tips, NIST recommends that you stop requiring employees to change their passwords in SP-800-63B. Why? Because users are more likely to use weak passwords or reuse passwords across multiple accounts for the sake of convenience if you require them to do so frequently. Or, they may just add \u201c123\u201d or something similar to the end of their existing passwords. Again, this practice may be convenient but it doesn\u2019t make for more secure passwords.<\/p>\n\n\n\n NIST recommends allowing the copy-paste functionality for password fields because it encourages the use of password management tools and apps. Users can use password managers to generate and store complex passwords. Considering that NordPass reports the average user has upwards of 80 passwords<\/a>, it\u2019s no surprise that password managers are becoming increasingly popular with certain age groups.<\/p>\n\n\n\n HYPR\u2019s The State of Passwordless Authentication 2021 report<\/a> shares that 39% of Millennials and 24% of Generation Z adults use password management apps. That\u2019s because password managers offer convenience for individuals who want to use more complex passwords but don\u2019t want to have to remember all of them individually.<\/p>\n\n\n\n Although password hints may seem like a great idea, they actually pose a significant risk to account and password security. As such, NIST guidelines specifically state that you shouldn\u2019t allow users to store hints that are viewable to unauthenticated users. Furthermore, they also speak out against using specific types of personal information for password security verifiers, such as \u201cwhat is your mother\u2019s maiden name?\u201d<\/p>\n\n\n\n Integrate various lists into your password security system to force users to create more secure passwords. For example, you can create \u201cblacklists\u201d of passwords or passphrases that employees can\u2019t use. You can develop these lists using:<\/p>\n\n\n\n If a user tries to use one of these prohibited options, prevent the password creation process from moving forward until they enter a different password or passphrase.<\/p>\n\n\n\n Much like the previous item on our list, you can use lists of known breached passwords as another password creation security measure. That\u2019s because breached password lists are easy to find online and make great resources for your organization. If any of the passwords users try to create match the ones on your lists, your system will automatically require them to enter a different value. <\/p>\n\n\n\n You can find massive breached password lists<\/a> on the website haveibeenpwned.com<\/a>.<\/p>\n\n\n\n Most password security tips only focus on recommendations for creating strong passwords. But another important aspect of password security is ensuring that users are using secure connections when logging in to your internal sites, web apps, and other secure resources.<\/p>\n\n\n\n A virtual private network (VPN) is a great option for employees who are working remotely. That\u2019s because a VPN allows users to enter their login credentials to connect and transmit data securely over the internet using encrypted connections. Without encryption, any data you transmit \u2014 including your usernames and passwords \u2014 bounces around the internet in an unsecure (i.e., readable) format. This plaintext data is something that cybercriminals and other bad guys can easily intercept, steal, modify or use without your permission.<\/p>\n\n\n\n10 Password Security Tips to Implement Within Your Organization<\/h2>\n\n\n\n
1. Require Employees to Use Strong Passphrases Instead of Passwords <\/h3>\n\n\n\n
2. Educate Your Employees On Password Security<\/h3>\n\n\n\n
3. Only Store Salted Password Hashes<\/h3>\n\n\n\n
4. Don\u2019t Require Periodic Password Changes<\/h3>\n\n\n\n
5. Allow Users to Copy and Paste Passwords Into Login Forms<\/h3>\n\n\n\n
6. Disable Password Hints<\/h3>\n\n\n\n
7. Develop a Password Blacklist to Compare User-Generated Passwords\/Passphrases Against<\/h3>\n\n\n\n
8. Make Breached Password Lists Another Password Security Bulwark<\/h3>\n\n\n\n
9. Require Users to Use a VPN When Connecting to Your Secure Resources<\/h3>\n\n\n\n
10. Get Rid of User Passwords Altogether<\/h3>\n\n\n\n