A password is like underwear. I know. Not what you expected to read on Cyberr. But now that the image is in…
Florian D. — Consultant Senior - Tech Lead - Cybersecurity
A password is like underwear.
I know. Not what you expected to read on Cyberr.
But now that the image is in your head, it's staying there. Which is exactly the point. 😏
Because in cybersecurity, the problem is almost never technical. It's human.
You can stack firewalls, EDRs and group policies all you want: if the password is sitting on a sticky note under the keyboard, none of it matters.
So let's go through it, one step at a time:
-> You don't hand it out. Not to the colleague who "just needs 2 minutes." Not to "support, just to verify."
-> You don't leave it at your desk. The sticky note under the keyboard is the all-time classic. We find it in 4 seconds during an audit.
-> Size matters. And counterintuitively: length protects you far more than special characters. i-love-my-blue-bike-2024 is tougher to crack than P@ss!2. A passphrase beats gibberish nobody can remember.
-> You change it… when you actually need to. And no, not every 90 days "on principle", that rule is dead (NIST, ANSSI). You rotate on a confirmed breach or real suspicion. The rest of the time, you turn on MFA and breathe.
The real best practice today? A password manager + MFA everywhere. Now you only have one pair to keep track of. The right one.
👇 Tell me in the comments: the sticky note under the keyboard, have you ever actually spotted one at your company? (Be honest.)
At Humanix, we believe cyber is human before it's technical. No fear, no jargon: just reflexes that hold up.
#Cybersecurity #Passwords #SMB #NIS2 #SecurityAwareness #HumanixCybersecurity
4 reactions · 2 comments
Topics: #nis2, #securityawareness, #humanixcybersecurity, #smb, #cybersecurity, #passwords
Comments
Joshua C.: Change it regularly used to be good advice, but it isn't in line with the current NIST requirements. SP 800-63B-4 says: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised.” The better question is, why are you still using passwords in the first place?
Florian D.: Joshua Copeland exactly, we have to stop using passwords, or at least in this form. we should have MFA everywhere, it's a minimum and it's proven with Fortinet or a cluster of 42 GPUs could break 20 character passwords in a few seconds...