The NIST Cybersecurity Framework (NIST CSF) is a set of guidelines developed by the National Institute of Standards and Technology to help organizations improve their cyber defenses. Whether a company's IT managers are only getting started in establishing a cybersecurity program or already running one, they can use NIST CSF to ensure cybersecurity best practices are implemented across the organization.
NIST CSF has five core functions, including:
One of the key tenets of the NIST cybersecurity framework is establishing a strong password policy. These password guidelines are fully outlined in NIST SP 800-63, but for today, let’s take a look at some of them below!
As a best practice, NIST CSF password guidelines suggest an eight-character minimum for user-made passwords, and a six-character minimum for machine-generated ones. They also recommend creating passwords that are up to 64 characters long, and support passwords that contain emojis and characters listed within the American Standard Code for Information Interchange.
The original NIST CSF password guidelines recommended resetting passwords every few months. However, newly released guidelines advise against doing this because forcing users to regularly change their passwords can lead to users choosing weaker passwords that are easier to remember.
Following the new password guidelines, businesses must only require password resets in the event of a data breach.
For many years, IT experts advised users to create passwords that contained at least one lowercase letter, one uppercase letter, one number, and one symbol.
Now, NIST recommends using longer passwords that are easy to remember, such as passphrases. These types of passwords use random dictionary words that can be separated by spaces, combined into one string, or mixed in with numbers. In general, ‘passphrases’ are difficult to crack, so they offer better protection than complex passwords.
When users forget their password, they can be provided with a hint, or asked to answer security questions like, “What is your mother’s maiden name?” or “What was the name of your first pet?”. While answering these questions may be convenient for most, it can be risky. Through a quick online search, cybercriminals can often guess the answers and therefore gain access to your accounts. For these reasons, NIST is advising against using password clues as a way to verify user identity.
Many login sites don’t support the “Show password while typing” option. However, the NIST CSF password guidelines recommend allowing users to view their passwords as they enter them. Without this option, users may be more inclined to choose weaker passwords that are easier to enter correctly.
The guidelines also suggest allowing users to paste passwords, allowing people to create and store stronger passwords within password managers.
Having an unlimited number of login attempts may help users who have forgotten their passwords - however, this can be risky. Unlimited attempts give cybercriminals unlimited opportunities to force their way into systems. To prevent this, NIST recommends limiting the number of login attempts to 10 at a time.
SMS authentication is the process of verifying a user's identity by sending a code to their mobile phone through a text message. NIST CSF password guidelines discourage SMS authentication, as it’s not secure. For one, cybercriminals can easily intercept SMS messages. They can also use social engineering techniques to convince telecom providers to transfer a victim’s mobile number to a SIM card in their possession.
Instead, the NIST recommends using more secure authentication methods such as biometrics, multi-factor authentication, and app-based one-time passwords.
Complying with NIST CSF is not an easy task. Thankfully, a reliable managed IT services provider like Charles IT can help. We will ensure that you achieve total security through our three-step process:
Drop us a line today to get started with your NIST CSF compliance journey!