What is Authentication?

You know that cybersecurity is a problem, but do you know what to do to fix it? For many organizations, the first step is writing and enforcing a strong password management policy. In addition, there are a number of best practices, like user education, and using multi-factor authentication (MFA) and password managers, that can help users strengthen an organization’s human firewall. 

Every company should have a comprehensive password management policy as part of their overall information security policy. It should be implemented across all impacted systems and should be shared and enforced among all end users. The policy should be discussed thoroughly and repeatedly so everyone understands the requirements and how to follow them. The best policies cover a minimum of topics such as password length and complexity requirements, password history and reuse, options to reset, change requirements and storage protocol. 

The National Institute of Standards and Technology (NIST), a U.S. government agency and technical leader, released updated guidelines for digital identity in 2017.  They are published in the NIST Special Publication 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management. Much of the publication addresses technical recommendations for coding secure authentication and password storage systems. However, it also includes updated recommendations for creating secure passwords or PINs and authentication processes. These recommendations include:

1. Requiring at least 8 characters and up to 64 characters, but no other complexity requirements
2. Using a set of characters that is NOT on a blacklist of compromised or most commonly used passwords
3. Using random words or concepts as passwords, rather than family names, addresses, meaningful dates, or other personal details
4. Not allowing secret questions or hints to gain access to an account if the user has forgotten their password
5. Only forcing a password change if there is evidence that the password has been compromised

So how does one write a secure but memorable password that is long enough but does not include any personal details? The most important factor is length. Each additional character makes cracking the password a more difficult task. After length is uniqueness. The two ways to gain someone’s password are to crack it or guess it. Using personal details for a password makes it much more guessable; so does using a dictionary word or published phrase. However, stringing together random words in an unfamiliar pattern, possibly including a number or special character, creates a unique code that only the user knows. Here are a few suggestions for increasing length and uniqueness:

1. Combine words and numbers from a familiar room into a sentence.
   • E.g., 8MugsandPlates1Cabinet
2. Use homophones.
   • E.g., Way2TooTwoWeigh
3. Use the same sequence for numbers and special characters.
   • E.g., Include 8787 and *&*&, which is 8787 while holding down the Shift key
4. Truncate long, familiar words to create something familiar to you but hard to guess.
   • E.g., If you were born in San Francisco, truncate it to Franci
5. Choose words from favorite but old personal memories.
   • E.g., 8yrsNewDogCampGrade2
6. Choose words from a specific page in a favorite book
   • E.g., From the first sentence of Pride and Predjudice, page 1 by Jane Austen:  TruthManFortuneWife
7. Mix and match techniques to create long memorable passwords.
   • E.g., OldHouseFranci1875!*&%

Passwords are only one aspect of authentication. Multi-factor authentication means combining two or more authentication methods at a time – meaning pairing a password (What you know) with a one-time code (What you have) or biometric marker (Who you are) to your login. This tactic adds one more roadblock to anyone trying to access your account. MFA is especially helpful in reducing the effects of social engineering or eavesdropping theft of passwords.

The most widely available two-factor authentication is from an app that sends a code by email or text to a smartphone. In addition, adoption is increasing of cards and dongles that generate the one-use codes. Although not always available, if you have an MFA option with any account, you should use it.

If you’re going to require different complex passwords for each account, then it’s only fair to give users a tool to manage them. A study from the Carnegie Mellon Computer Science Department found that when users are annoyed by an organization’s password policy, they are 46% more likely to have weak passwords.(4)   Thus, providing a tool to reduce annoyance and difficulty with complying is likely to improve password strength as well as user satisfaction. Unfortunately, only 22% of organizations currently require employees to use a password manager. Over half of respondents to two Ponemon surveys rely on human memory.(1, 3)

There are a number of strong password managers available now that make password management seamless and fairly easy. The advantage of using a password manager is that the user must only remember one long and strong password to open the tool. Then the tool remembers passwords for all the saved accounts. Most tools also have a password generator to help users craft strong passwords for every account. A password manager should be used for both professional and personal accounts to help users implement and keep track of unique passwords for each of their accounts rather than reusing the same password across the board. Most password managers also offer two-factor authentication for login or limit password storage to the local device to further secure such valuable data.

Finally, teaching users is a critical step for any organization trying to build their human firewall. Employees must understand why passwords can be insecure, what information they are protecting and why it is important. If not, they are much less likely to invest attention and effort in any solution. Additional topics that should be covered in security awareness and password management training include:

1. Writing stronger passwords, or better yet, using a password generator. 
2. Using security tools like MFA and password managers.
3. Following security best practices when using an insecure network like public WiFi.  

Writing policies only goes so far.  To increase system security, the system’s users must understand and follow the policies, use the tools and invest in building a secure organizational culture.