About Us | Contact Us
View Cart

Former NIST Official Regrets Issuing Password Guidance

By Vigilize | Monday, August 21, 2017 - Leave a Comment

Bill Burr admits security advice actually created more vulnerable passwords.


An article review.


ServIcons_ITAudit_01If you’ve ever angrily questioned some seemingly arbitrary rule when creating a new password, there is some vindication for you: the former government official whose password security suggestions became the basis for many organization’s own standards now says he regrets writing the document.

These regrets came to light in a recent article, which came to us by way of Wes Pollard at Home Bank. In the article, former NIST Manager Bill Burr admitted his 2003 NIST Special Publication led to users taking “lazy shortcuts” and using predictable methods when creating passwords, making them easier to crack.

Burr also now disagrees with his recommendation to have passwords expire after 90 days–something that we have spoken about here on multiple occasions!

Now, instead of dancing on the grave of the aging myth that was included in the original NIST Special Publication 800-63, let’s address the still confusing issue of password make-up.  Bill Burr also regrets that fact that many people are now using “predictable phonetics” to make their passwords strong.  Many of you who have received training from infotex may think that we too regret our advice, which USED to mirror the strong password makeup suggestions of the NIST publication.

While we do admit that we too suggested using @ for a and $ for s, that was more than a decade ago.  We long ago changed our approach, suggesting that you use sentences longer than 14 characters in length, use disparate words I your sentences, mix up your themes, etc.  We still teach the six factor makeup, and still believe in it, whenever you can’t use long sentences of disparate words.  And we’d rather users adopt the practices pushed in the NIST guidance than no practice at all.

So yes, 11 years ago we agreed with NIST guidance, but since we have been trying to get the world to see that the best password is a sentence of disparate words.  For example:  Original USED admit decade could be a password, all based on words used in this paragraph.  The infotex policy is still to throw a password that is “strong” as defined in the original NIST guidance.  Thus, in order for the above password to comply with infotex policy, we’d need to add an eight character “strong” password in there somewhere, like Original USED admit decade $tr0ng3r!  (Yes, we’re using a $ for an s, a zero for the oh, and a 3 for the e.  But we still maintain the likelihood of you guessing that, even if you KNEW it was a phonetic of “stronger,” is very, very low.

 


Original article by Nick Statt, writing for The Verge.


same_strip_012513


 

Latest News
    What are the top seven risks your board should know about in 2021? Since his first board presentation in 2000, when Dan presents audit reports to boards of directors, he also talks to the board about the top risks the institution is facing. Since 2006, Dan has been compiling a list of the “top seven […]
     A Timeline Update as of 02/22/21 An update to our Newest Employee’s FIRST Technical Article Another interim post-mortem review . . . . A Note About Updates: We have decided to leave the original article as it was originally posted and to update this post with any changes that have been made. You can see […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office.  
    A Webinar-Movie The 2020 annual webinar update on the subject will include a review of the previous years’ movies that are already available, and a discussion about alternative tactics that have arisen from recent virtual conferences and regulator panels.
    The cybersecurity industry faces challenges, and some of them may involve your business… An article review. In a world where threats to your organization’s electronic assets are constantly emerging and evolving a cybersecurity insurance policy can help mitigate risk…but what kind of risk does the cybersecurity insurance industry face?  A new article in the Harvard […]
    A Timeline as of 01/24/2021 Our Newest Employee’s FIRST Technical Article Another interim post-mortem review . . . . A Note About Updates: We are leaving this article as is, but for any updates to the timeline, check the Autopsy of the SolarWinds Hack Timeline Update article!      – Vigilize Introduction: As the managing […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS FORUM AND CONFERENCE NEWS infotex is proud to announce that Dan Hadaway will be moderating a series of IT Forums for the Ohio Bankers League. “We are excited to continue fostering the relationship with the OBL to help educate and keep Risk Management at the forefront of […]
    Top 7 Trend Articles of 2021. . .  . . .For ISOs of Small Financial Institutions. Welcome to our annual T7 article:  a list of our favorite trend articles from the past year.  Our intent: help you organize your thoughts as your work through your strategic planning process.  We hope reviewing these articles will help you […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office.  
    A Webinar-Movie In our current world of uncertainty there is at least one thing that is certain. Business needs to continue, and that means that it is important for managers to be able to meet with their team even if everyone is working remotely at this point. In this Webinar-Movie, Dan will compare virtual meeting […]