What are the key changes in the NIST 2024 password security guidelines?

The NIST 2024 password security guideline introduce several key changes, including removing mandatory password rotations, recommending longer password lengths (at least 15 characters), eliminating password composition requirements, and prohibiting the use of password hints and security questions. The NIST 2024 password security guideline also emphasize the use of centrally verified passwords and suggest using a stop-list to block commonly used passwords.

Why did NIST discontinue mandatory password rotations?

NIST found that scheduled password rotations often lead users to create predictable and less secure passwords. By eliminating this requirement, NIST 2024 password security guideline encourage users to create stronger, longer passwords that don’t need frequent changing, enhancing overall security and reducing user frustration.

How does NIST recommend handling compromised passwords?

NIST 2024 password security guideline mandate immediate resetting of passwords if they appear in data breaches or are otherwise compromised. Organizations should implement tools to monitor and detect compromised passwords in real-time, ensuring quick action if a user’s password becomes insecure.

What is the difference between centrally verified passwords and activation secrets?

Centrally verified passwords are sent from the user to a server over a secure channel and meet standard password requirements. Activation secrets, on the other hand, are local passwords or PINs used to access on-device key storage. They have distinct requirements, such as limited retry attempts and shorter recommended lengths.

Are there restrictions on multi-factor authentication (MFA) methods in the 2024 guidelines?

Yes, NIST 2024 password security guideline specify that only phishing-resistant MFA methods are acceptable for the highest assurance level (AAL3). This includes cryptographic authentication methods like USB tokens and digital wallets. Insecure methods, such as OTPs sent through email or VoIP, are prohibited, though SMS-based OTPs are still allowed for lower assurance levels (AAL1 and AAL2).

Tag

cybersecurity

Articles

Loading Content

$ loading --articles --category="cybersecurity"

Fetching latest articles...

No Articles Found

We couldn't find any articles matching your criteria

Find systems, projects and engineering notes.

cybersecurity

Advanced Filters

Tags

Date Range

No Articles Found

{post_title}

NIST 2024 Password Security Guidelines: Essential Updates for Digital Safety

NIST 2024 Password Security Guidelines: Essential Updates for Digital Safety

From Insights