Common Guidance on Passwords

Common Guidance on Passwords

Protecting Your Accounts and Devices

We believe that using stronger authentication is one of the most effective and inexpensive steps that can be taken to secure organizations and people online. On World More Than A Password Day, November 10, 2023, together we are issuing this Common Guidance on Passwords specifying simple steps that anyone can take to be more secure:

Steps to Take Now

1. Use password-free authentication

Use password-free (passwordless) authentication, such as passkeys (sometimes other terms are used), when you can. Passkeys are  simpler to use and far more secure than passwords. Passkeys use cryptography to prove that you are you for online sites and services, employing a secret key that is stored on your device  and is never shared. The most popular operating systems, browsers, and email services support passkeys – just search for “passkey” and the name of your operating system, browser, or site/service.

2. Secure your email account

If using password authentication for your email accounts, use a very strong password (long, randomly generated, and unique (see https://www.cisa.gov/sites/default/files/2023-08/Secure-Our-World-Passwords-Tip-Sheet.pdf) and multi-factor authentication/two-step verification (see the next step below). Email is the most common form of resetting your password, and you want to make sure no one else can “reset” your passwords and get access to your accounts.

3. Add an extra layer of security above using passwords alone

Using a hardware security key or token, an authenticator app or a PIN provided by SMS messaging as a “second factor” in addition to your password can help prevent phishing and other attacks. This process can be called multi-factor authentication (MFA), two-factor authentication (2FA), or two-step verification. The better form of additional security is to use a hardware token or an authenticator app on your phone, and not to rely on SMS messages for the second factor.

4. Use a password manager

Especially if you have accounts that use only a password and not passkeys or a second means of authentication, use a password manager so you don’t have to remember all your passwords. Using a password manager means you can use strong, randomly generated passwords that are much harder to guess. Software password managers, browsers that manage your passwords, and operating systems can all do a good job. Of course, your password manager password has to be both strong and memorable (see the next step to pick a good password), and you must respond quickly and change all your passwords if your password manager service is compromised. More detailed guidance on password managers is available, for example, from the UK  Password managers: using browsers and apps to safely store your passwords, and Canada Password managers-security.

5. Use a recommended technique to pick passwords

If you are picking your own passwords rather than having your computer or password manager generate them, you can use a passphrase (Best practices for passphrases and passwords (ITSAP.30.032) – Canadian Centre for Cyber Security) or a technique like the UK NCSC’s “Three Random Words” to pick passwords that are easier to remember but hard to guess. https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words.

If You are “Hacked”

6. Changing passwords

Your passwords should be changed immediately if one of your devices is compromised (for example, a hacker installs malware on your computer). If an online site or service you use (an email service, a website, etc.) is hacked, change your password for that site or service and anywhere else you have reused that password (and you really should not reuse passwords). Subscribing to https://haveibeenpwned.com/ is a good way to discover if you have passwords you need to change. Last, it’s best to change passwords using a device that hasn’t been compromised.

Note for providers: Require or support strong authentication rather than requiring that passwords be periodically changed.

Reprinted with permission from Nonprofit Cyber.

Signed By

These are the supporters of this campaign:

• American University
• Anti-Phishing Working Group (APWG)
• Aspen Digital
• Australian Cyber Collaboration Centre
• Aviation ISAC
• BBB Institute for Marketplace Trust
• Bfore.Ai
• Black Girls in Cyber
• C3Initiative
• Canadian Cyber Threat Exchange
• Center for Democracy & Technology
• Center for Internet Security
• Center for Threat-Informed Defense
• Charter of Trust
• Cloud Security Alliance
• Consumer Reports
• Craig Newmark Philanthropies
• CREST International
• Cyber 4.0 Cybersecurity Competence Center
• Cyber Defence Alliance
• Cyber Threat Alliance
• Cyber Readiness Institute
• Cyber Risk Institute
• Cyber Security & Forensics Association Uganda
• CyberGreen Institute
• CyberPeace Institute
• Cybersecurity and Infrastructure Security Agency (CISA) U.S Department of Homeland Seccurity
• Cybersecurity Network Foundation
• Cybersecurity Tech Accord
• Cybertrust America
• CyberWA, Inc
• CyberWyoming Alliance
• DECO PROTeste
• Dell Technologies
• DISARM Foundation
• DNS Research Federation
• Dominio PuntoGal
• eco – Association of the Internet Industry
• EURid
• Euroconsumers
• European Cyber Security Organisation (ECSO)
• European Cybercrime Centre – EC3 – Europol
• FIDO Alliance
• Forge Institute
• Forum of Incident Response and Security Teams (FIRST)
• Get Safe Online
• Girls Who Code
• Global Anti-Scam Alliance
• Global Cyber Alliance
• Global Resilience Federation
• Hacking the Workforce
• Health-ISAC
• HIKS
• Institute for Security and Technology
• INTERPOL
• Kenya CyberSecurity & Forensics Association
• Maritime Safety & Security Alliance
• Microsoft
• National Council of ISACs
• National Cyber Forensics and Training Alliance
• National Cybersecurity Alliance
• National Cybersecurity Society
• Netsafe
• Nomad Futurist
• NSI Cyber and Tech Center, Antonin Scalia Law School at George Mason University
• Open Cybersecurity Alliance
• OWASP
• Packet Clearing House
• PUNTU.EUS
• R Street Institute
• Rapid7
• Recorded Future
• Retail & Hospitality ISAC
• SAM for Compliance
• ScamAdviser
• SecureTheVillage
• Security Scorecard
• Serianu
• Shadowserver Foundation
• #ShareTheMicInCyber
• Sightline Security
• Society of Citizens Against Relationship Scams Inc. [SCARS]
• South West Cyber Security Cluster
• STOP. THINK. CONNECT. Messaging Convention
• TechSoup
• The Kosciuszko Institute Association
• UC Berkeley Center for Long-Term Cybersecurity
• Women4Cyber Foundation
• XRSI – X Reality Safety Intelligence
• youthprotect e.V.

Source