The Cybersecurity and Infrastructure Security Agency (CISA) just published new password requirements and it can be counterintuitive to say the least. Unfortunately, it doesn’t seem like they did a great job of explaining why things are changing and what the changes mean, so I’ll do so here.
For at least five years now, researchers have been showing that complexity and rotational requirements, special characters like ^%$! and rotating to new passwords every 90 days(or 30, 60, 120), is actually less secure. This is where it becomes counterintuitive and when trying to just say we’re going to change the password requirements based on new standards falls flat. You would assume that making things more complex and changing them makes a password more secure, and you would be right in a technical sense. When taking the overall picture, though, this breaks down. Special characters means passwords are harder to come up with and harder to recall and being forced to change them four times a year is a burden, especially when you consider the average user has to have passwords for 30 different things between their work and personal life. (LOOK THIS UP!) So, the average user with their average amount of passwords is now making it as easy as possible to remember and that means using the same password everywhere they can and as often as possible, only changing up with a different character. Most people in IT know that Spring2022! is pretty insecure, but usually works within password requirement restraints. Oh, and then when it’s time to change we’ll just go ahead and make it Summer2022!. Problem solved.
So, the likelihood of a breach becomes higher because your users are now reusing their Pinterest password, bank password, and work domain password. Cybersecurity does not exist in a bubble and neither should the policies we live by. I’m sure from a technical standpoint password requirements can be created to not include common words, dates, and whatever else we could dream up, but users will probably still write them down and lose them, email them to themselves, put it in a spreadsheet with all their other passwords in a Google Doc, or whatever else they could do to make it easier. They flow in the path of the least resistance and we need to give that to them. In the case of passwords, the path of least resistance is longer but with fewer constraints. At least 12 characters, but with no requirement for special characters and don’t reset it unless there’s some need. Tell them to use a phrase that makes sense to them. I look around my office walls for words to make into phrases.
Fiscally speaking, you aren’t going to have as many calls coming into your IT help desk or lone IT person for help with a password. If you can cut down on workload you can keep from having to add staff or be able to concentrate on projects and priorities that matter to the organization more than helping someone reset their password four times after they reset it because they can’t recall it or wrote it down incorrectly (once again, writing it down!)