Bare Cove Technology’s Australia Director Mats Parkinson has shared a great summary of the recent NIST release on implementing digital identity services below. Thanks Mats Parkinson for your insights! #cybersecurity
The National Institute of Standards and Technology (NIST) recently released the updated Special Publications (SP) 800-63B, outlining the technical guidelines for organisations implementing digital identity services. See https://lnkd.in/gVT3sDei The "Password Verifiers" section outlines a 𝗺𝗼𝗿𝗲 𝗺𝗼𝗱𝗲𝗿𝗻 𝗮𝗽𝗽𝗿𝗼𝗮𝗰𝗵 𝘁𝗼 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 and the move away from overly complex passwords and password policies. Instead, it emphasises using longer passwords and passphrases with more memorable combinations of words that reduce the predictability patterns that make them easier to crack. The new password requirements include several key updates: • 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗟𝗲𝗻𝗴𝘁𝗵: Emphasis is placed on 𝗹𝗼𝗻𝗴𝗲𝗿 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 rather than complex composition rules. The minimum recommended length is 8 characters, the suggested length is 15, and the maximum length of at least 64 characters. • 𝗖𝗼𝗺𝗽𝗼𝘀𝗶𝘁𝗶𝗼𝗻 𝗥𝘂𝗹𝗲𝘀: Traditional complexity requirements (e.g., including uppercase letters, digits, and symbols) are 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗲𝗱. Instead, users are encouraged to create longer, more memorable passwords. • 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗘𝘅𝗽𝗶𝗿𝗮𝘁𝗶𝗼𝗻: Routine 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗲𝘅𝗽𝗶𝗿𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝗱𝗶𝘀𝗰𝗼𝘂𝗿𝗮𝗴𝗲𝗱 unless there is evidence of a compromise. • 𝗦𝗰𝗿𝗲𝗲𝗻𝗶𝗻𝗴 𝗔𝗴𝗮𝗶𝗻𝘀𝘁 𝗖𝗼𝗺𝗺𝗼𝗻 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀: Passwords should be 𝗰𝗵𝗲𝗰𝗸𝗲𝗱 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 𝗹𝗶𝘀𝘁𝘀 𝗼𝗳 𝗰𝗼𝗺𝗺𝗼𝗻𝗹𝘆 𝘂𝘀𝗲𝗱 𝗼𝗿 𝗰𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 to prevent easy guessing. • 𝗡𝗼 𝗞𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲-𝗕𝗮𝘀𝗲𝗱 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻: Knowledge-based authentication (e.g., first pet) is 𝗱𝗶𝘀𝗰𝗼𝘂𝗿𝗮𝗴𝗲𝗱 due to its known vulnerability. • 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗠𝗮𝗻𝗮𝗴𝗲𝗿𝘀: Password managers are 𝗲𝗻𝗰𝗼𝘂𝗿𝗮𝗴𝗲𝗱 𝘁𝗼 𝗵𝗲𝗹𝗽 𝘂𝘀𝗲𝗿𝘀 𝗺𝗮𝗻𝗮𝗴𝗲 𝗽𝗮𝘀𝘀𝘄𝗼𝗿𝗱𝘀 securely. We always recommend implementing MFA and Conditional Access Policies to help protect your identities even further. And of course, you can always move to use passwordless authentication (or passkeys) and negate the need for a password at all! #BareCoveTechnology