Identity and Access Management

This chapter is about identity and authentication. We will be discussing the importance of multi-factor authentication and why you need it. We’ll cover NIST’s new password requirements and why they have changed. Finally, we’ll discuss how to ensure your passwords are secured using a password manager and are securely stored.

In this chapter, we’re going to cover the following main topics:

• Two-factor authentication and why you need it
• Password complexity and NIST 800-63-3B
• Password manager

Two-factor authentication and why you need it

The importance of multi-factor authentication cannot be overstated. The CEO of True Digital Security, Rory Sanchez, stated that, “Almost every phishing attack that we’ve seen could have been prevented with multifactor authentication.”1 If you are a data-driven person like myself, maybe this will convince you; Microsoft says that “MFA can block over 99.9 percent of account compromise attacks.”2

1 https://www.channelpronetwork.com/article/making-work-home-security-work

2 https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/

Typically, you log in with a username and password for most applications and websites. The best defense against account attacks is to use multi-factor authentication, also known as two-factor authentication

(2FA). Two-factor authentication means that in addition to the first form of...

Password complexity and NIST 800-63-3B

You may have heard about the “new” NIST 800-63-3B password requirements and guidelines. I will cover the highlights of the new guidance for authenticators, where they got it right, and where to be cautious. It is important to highlight the major changes that have taken place and what they mean for individuals and businesses that use passwords to secure their data.

The NIST 800-63-3B guidelines for password management are the most recent version of password security standards from NIST. NIST 800-63-3B is a complete turnaround to what we typically think of as a secure password. You’ll still hear people say the guidance is new, but it was released in June 2017. The IT Industry has been rather slow in implementing the new guidance into their products and applications. The guidelines provide more flexibility to users while maintaining security standards.

Traditionally, the longer and more complex a password, the harder it...

Password manager

I recommend using a password manager such as Bitwarden, 1Password, or LastPass. By using one of these password storage applications, you can create individual strong and complex passwords for each application and website. You only have to remember the password manager’s password. The password manager will also check the Have I Been Pwned (https://haveibeenpwned.com/) website to alert you if a password has been cracked and is posted on the dark web. You can check your email addresses and passwords on the site. A password manager is also a great way to securely store shared passwords. Ideally, you do not want to use shared passwords. There seem to always be some passwords that need to be shared within a team. These should be stored securely in a company-provided password manager and used sparingly. Ensure that these shared passwords are changed once a team member either moves to another department or leaves the company. This should be part of a formal process...

Quick reference

Ideally, your company’s identification and authentication compliance should include the following:

• Basic:
  • Multi-factor authentication for every user
  • A 14+ character passphrase
  • Unique passwords
  • Password manager
• Medium:
  • Multi-factor authentication for every user
  • A 14+ character passphrase
  • Unique passwords
  • Passwordless
  • Context awareness
  • Password manager
• Advanced:
  • Multi-factor authentication for every user
  • A 14+ character passphrase
  • Unique passwords
  • Passwordless
  • Context awareness
  • Password manager
  • Device authentication
  • Hardware token

Summary

The NIST 800-63-3B guidelines have received a fair amount of criticism for contradicting the previous password guidelines imposed by NIST, such as password-expiration policies, using special characters, and complexity requirements. The guidelines have been criticized for allowing users to use passphrases as passwords without complexity, even though the strength of passwords based on characters only are technically weaker passwords. Even so, the guidelines do provide some good information. I recommend taking what is useful and marrying it with the latest information we have in order to secure your passwords.

In conclusion, using multi-factor authentication is imperative to prevent phishing and account attacks. The NIST 800-63-3B guidelines represent a move toward flexibility in password creation and emphasize education, but it is crucial to be cautious about where they may differ from previous password guidelines. The implementation of the guidelines should be a priority...