Admit it – remembering passwords is a hassle. Crafting complex and unique ones is a challenge, and using the same password everywhere is a risky shortcut. The key? Shift your mindset from random character sequences to memorable words or phrases.
We’re all aware of the critical role passwords play. Verizon reports that 83% of initial breaches occur due to compromised credentials. To safeguard yourself, steer clear of predictable patterns like ‘qwerty’ or ‘12345’, significant dates, or names of favorite sports teams or loved ones.
These choices are easily guessable and pose a security threat. So, what’s the alternative to complex passwords? The answer lies in creating passphrases that are both secure and memorable.
Can’t Remember!!!!
You may believe that a password’s strength comes from a mix of seemingly random uppercase and lowercase letters, numbers, and symbols. However, these passwords aren’t as random as they appear. Instead of diversifying, user behavior is leading to more uniform passwords due to recurring patterns.
Why is this the case? Because complex passwords are hard to memorize, people have developed coping mechanisms to meet security requirements, often reverting to familiar patterns. Take, for instance:
- A well-known word or sequence from the keyboard as the base
- Capitalizing the initial letter
- Adding numbers and a special character at the end
- Using common substitutions (like ‘@’ for ‘a’, or ‘0’ for ‘o’)
Following this formula, ‘difficult’ might become ‘D1ff1cult2024!’. This might satisfy the default password policies of many organizations, including Active Directory.
Yet, these tactics are well-known to attackers, who can easily program software to predict them. Criminals exploit this knowledge, refining their brute-force and hybrid dictionary attacks to be more effective.
The Challenge of Lengthy Passwords
It’s understandable why many opt for the same password across various accounts. Bitwarden’s research indicates that 68% of internet users juggle passwords for more than 10 sites, with 84% confessing to reusing passwords. This habit significantly heightens the risk of password compromise.
A straightforward method to bolster the passwords in your directory is to extend their length, making them tougher to decipher through brute force or hybrid dictionary attacks.
Indeed, length can equate to strength in passwords. Yet, we encounter the familiar issue of complexity. Long, random character strings are notoriously difficult to remember, potentially leading us back to the starting point.
The solution? Craft lengthy passwords that are memorable. Enter passphrases. Consider the following two passwords: one is a mere eight characters, while the other spans 21 characters.
- Range-Helping-Tiger
- 37*rlf@rt
Is the second password superior due to its complexity? Not necessarily.
The first example benefits from its length. More crucially, which one will you actually recall?
For the majority, it’s the extended phrase.
Even US authorities acknowledge passphrase advantages. The FBI, referencing National Institute of Standards and Technology (NIST) guidelines, emphasizes that password length trumps complexity. “Opt for passphrases that merge multiple words and exceed 15 characters… Robust passphrases can also shield against breaches of personal data,” the FBI advises.
Pro Tips
Transitioning from passwords to passphrases might seem like a big step, but there are straightforward strategies to ease the process. For example, the UK’s National Cyber Security Centre suggests combining three unrelated words. Similarly, the Canadian Centre for Cyber Security advises that a passphrase should consist of at least four words and be no shorter than 15 characters.
Random word generators can be a useful tool, and you could even encourage users to intentionally misspell a word – provided it remains memorable. Here are some guidelines for crafting effective passphrases:
- Embrace unpredictability: The essence of a strong passphrase is its randomness. Avoid sequences of related words, such as ‘Michael-Jordan-Basketball’. This also applies to words or phrases associated with your organization or field.
- Avoid repetition: It may seem self-evident, but breaking the cycle of reuse is challenging.
- Implement MFA: Adding multiple authentication layers significantly enhances security. This could involve a passphrase, a one-time code, and a biometric element, such as facial recognition. While not foolproof, it substantially complicates a hacker’s job.
Ask us about incorporating custom dictionaries of prohibited words into your Active Directory.
Fusion Cyber Group can can perpetually monitor your Active Directory for compromised passphrases.
These tips aim to fortify your digital security by advocating for longer, more memorable, and unique passphrases over traditional passwords.
Enhancing Security with User-Friendly Practices
The challenge lies in the inconvenience of creating secure passwords, whereby our experts will simplify this from an administrative perspective, allowing the choice between supporting extended passphrases or maintaining traditional passwords, and deciding how to convey this to the user.
It’s equally vital to ensure a seamless user experience. Additionally, you can implement length-based ageing, rewarding users with longer intervals between resets when they opt for extended passwords.
If you’re considering transitioning from passwords to passphrases without the hassle, consult with our team and we will illuminate how that will be outlined and implemented to meet your organization’s needs.
