Password Security
- •
def
- •
the set of practices governing how passwords are created, aged, and managed
- •
- •
complexity and length
- •
resist guessing/brute force by increasing entropy — avoid single words or obvious passwords, mix character types; a common minimum is at least 8 characters (requirements change as processing power increases); consider using a passphrase instead
- •
- •
age and expiration
- •
password age — time since a password was last changed; expiration — a password stops working after a set period (e.g., 30/60/90 days); critical systems might rotate more frequently
- •
- •
password managers
- •
store all passwords in a single encrypted, protected database, often including multifactor tokens; built into many OSes and browsers, with enterprise options offering centralized management/recovery
- •
- •
passwordless authentication
- •
authenticating without a password at all (e.g., facial recognition, a security key) — often used alongside a password or another factor rather than as the sole method, since many breaches trace back to poor password practices
- •
- •
related
- •