GreenLoop IT Solutions : Articles
Recommendation: Implement Modern Password Security
The Paradigm Shift:
Stop us if you’ve heard this before:
“Your password has to be 8 characters, has to have a capital letter, a number, a symbol and can’t contain your name. Also, you’ll need to change it every 90 days.”
In the past, this was relatively good advice and resulted in (mostly) secure systems. However, that’s no longer the case. Unfortunately many SMBs are still working from antiquated assumptions, and have resulting weak password security. The major need for evolution in this process is driven by the dramatic reduction in time required for threat actors to brute-force their way through password defenses. Where it once took years to guess a password by trying every possible combination, 8-character passwords can now be exposed in mere hours or days (try it out!), thanks to the processing power of standard workstations.
Especially as accounts are exposed to the world via Cloud services, “password spray” attacks that rapidly try vast combinations of known username and password combinations have become increasingly effective at compromising traditional password security.
This reality necessitates a fundamental reassessment of how SMBs protect their digital assets. Read on to discover how current best practices challenge all aspects of that “concoction of wild characters plus ritualistic changes” password paradigm.
Current Best Practices in Password Security
Length and Memorability: Aim for passwords that are at least 12-16 characters long. The length of your password is (practically speaking) more important than its complexity. Consider eliminating complexity requirements (e.g. special characters) in your organization and instead requiring passwords to be 12+ characters. Note that complexity does still play an important role, especially for shorter passwords, since each additional character set makes brute-force guessing your password exponentially more difficult.
To make lengthy passwords more friendly without compromising security, consider using passphrases, which often combine two or more words. Alternatively, use a password manager with a built-in password generator to create long, random passwords and store them securely. In that case, make sure to use a strong passphrase for your password manager “master password”.
Strategic, not Routine Required Rotation: Unless there’s evidence a password has been exposed, it’s actually more secure to avoid routine required password changes. This is primarily because as the number of passwords that must be memorized increases, it’s natural to revert to recycling passwords. Fatigued users change only a few elements each time, leading to a password that may be easy to guess if an older version has been leaked (think “Password1“versus “Password2“, or even “Spring2024!” vs. “Summer2024#“). Additionally, this has shown that it leads to an increase in people writing down their password in plain view, or otherwise storing them insecurely. Modern wisdom is to change your password only when absolutely necessary—just be sure to completely change all elements of your password when you do.
Avoid Password Re-use: Even a theoretically “strong” password is only as secure as the weakest site that it’s used with. It is critical to never use the same password (or predictable variations) for multiple websites, since it’s common for attackers to reverse-engineer passwords from breached websites, and then use these passwords to target those same users on other platforms. Using a password manager is the most convenient method to completely eliminate password re-use.
Use Multi-Factor Authentication Wherever Possible: In today’s digital landscape relying solely on passwords is simply insufficient, and without MFA it’s a matter of when, not if, your password will be leveraged against you. Phishing-Resistant MFA stands as the most effective barrier against unauthorized access, ensuring that even if a strong password is somehow compromised, your data remains secure.
Implement Password Protection: Many Microsoft 365 customers have the ability to use Microsoft Entra Password Protection to secure your on-premises passwords. It ensures both your cloud and on-premises passwords are not only theoretically secure, but checked against Microsoft’s extensive database of passwords that are known to the bad guys. When users set or change their password, only passwords that pass both traditional length/complexity checks and the cloud database check are allowed.
Consider Going “Passwordless”: It turns out the best password is often no password at all. Modern “passwordless” authentication methods replace the traditional username/password(+2FA) formula with much harder-to-hack methods such as biometrics, hardware tokens, certificates, and pre-authenticated devices.
Conclusion
The digital landscape is constantly shifting, and with it, our strategies for maintaining the integrity of critical systems for our clients. By embracing these updated practices, we can stay ahead of the threats posed by ever-advancing technology. If you have any questions or concerns about your password policy, GreenLoop is here to help. Please reach out to us and we would be glad to assist with a reimagining of your process.
