NIST Password Guidelines: 2025 Updates & Best Practices
Written by
John MartinezLast updated on:
October 21, 2025Reading time:
Contents
Built for Security. Loved by Devs.
- Free Trial — No Credit Card Needed
- Full Access to All Features
- Trusted by the Fortune 100, early startups, and everyone in between
The latest updates in NIST password guidelines shift focus from complexity to usability. Key changes include:
- Prioritizing password length over complexity
- Mandating compromised credential screening
- Encouraging passwordless authentication methods
- Eliminating forced password resets unless a compromise is suspected.
This guide will help you understand how to implement NIST's latest password recommendations to strengthen your organization's security posture, reduce user friction, and maintain compliance with current standards.
What Are NIST Password Guidelines?
NIST sets the gold standard for authentication security, originally designed for federal agencies but now shaping compliance across industries like HIPAA, PCI-DSS, and SOC 2. Its guidelines are grounded in real-world research, not outdated security folklore, addressing the failures of traditional policies—such as complexity rules and forced resets—that often lead to predictable passwords, reuse, and increased helpdesk calls.
Password security remains the foundation of digital access control, with 94% of data breaches involving compromised credentials. The National Institute of Standards and Technology sets the benchmark for password security through its Special Publication 800-63B. These guidelines shape how federal agencies, contractors, and private organizations protect digital assets.
Organizations follow NIST password guidelines because they reflect extensive research and real-world testing of authentication methods. Although initially developed for government systems, these guidelines have become the generally accepted framework for secure password practices for almost all industries.
đź’ˇSolution: StrongDM helps organizations implement NIST-aligned access controls by:
- Enforcing password screening against known breach databases
- Automating password policies to meet compliance across all systems
- Enabling passwordless authentication with phishing-resistant MFA
The Evolution of NIST Password Standards
From 2017 to 2020: Key Changes
The release of NIST Special Publication 800-63B in 2017 marked a fundamental shift in password security thinking. Research from Carnegie Mellon University supported NIST's bold move from traditional complexity rules toward length-based requirements.
This period introduced several groundbreaking changes. Organizations no longer needed to enforce regular password changes unless there was evidence of compromise. NIST also eliminated requirements for special characters and mixed-case letters, recognizing that such rules often led to predictable patterns like "Password123!".
Password screening against known compromised credentials became mandatory, while the guidelines introduced new standards for password storage. Verifying systems now had to implement salting and hashing with functions like PBKDF2, which significantly increased the required effort and raised the computational cost for attackers attempting to crack stored passwords.
SP 800-63B and Digital Identity Guidelines
The latest SP 800-63B guidelines indicate an evolution of the framework towards more authentication practices, partly because the framework now embraces passkeys and sync-able authenticators. This reflects the growing need for both security and user convenience in digital identity management.
NIST has organized this new approach around three key categories: phishing-resistant authentication methods, improved account recovery processes, and enhanced guidance for credential service providers. And to lend credibility to these changes, NIST authored a recent study that demonstrates how these changes respond directly to the surge in authentication-based attacks.
đź’ˇSolution: StrongDM provides phishing-resistant authentication and automated credential management, ensuring secure access with minimal user friction.
Latest Updates in NIST 800-63-4
In September 2024, NIST released the second public draft of SP 800-63-4, introducing substantial changes to password management. According to new research from NIST, the new guidelines eliminate mandatory password complexity requirements and periodic resets, focusing instead on password length and screening against compromised credentials.
The updated framework emphasizes passwordless authentication methods, with research showing that only cryptographic solutions like USB tokens and passkeys offer true phishing resistance. To address these changes, enterprises have to implement rigorous password blocklists with larger databases. The intended result, in the eyes of NIST is incrementally better protection against common password choices.
These changes reflect NIST's commitment to balancing security with usability. A cybersecurity survey reveals that organizations implementing these guidelines report reduced password-related support tickets while maintaining strong security postures.
Current NIST Password Requirements for 2025
The End of Complexity Rules: What It Means for You
What’s gone:
❌ Required uppercase, numbers, and symbols
❌ Mandatory password resets every 90 days
❌ Arbitrary complexity policies
What’s required now:
âś… Minimum 8-character passwords (15+ for privileged accounts)
âś… Password screening against compromised credential databases
âś… Support for passwordless authentication and passkeys
Minimum Password Length Requirements
Password length serves as the cornerstone of NIST's updated authentication framework. While the baseline requirement mandates a minimum of 8 characters, security research reveals that passwords under 8 characters can be cracked within hours using modern computing power.
A study by Kaspersky found that each additional character exponentially increases password strength, with 16-character passwords requiring centuries to crack using current technology.
💡Solution: StrongDM enforces NIST’s 15-character minimum for privileged accounts to prevent brute force attacks, while supporting up to 64-character passwords and password managers for secure storage.
Password Complexity Guidelines
NIST's dramatic shift away from traditional password complexity rules shows that a new authentication strategy is needed by organizations. A security analysis reveals that mandatory character combinations often lead to predictable patterns like "Password123!" that are easily cracked.
Enterprises have to focus on eliminating weak passwords through comprehensive blocklists rather than enforcing composition rules. In other words, there have to be measured in place that take password construction out of the hands of users.
According to recent cybersecurity data, when users face strict complexity requirements, 82% of them will create passwords following predictable patterns, and that makes them vulnerable to dictionary attacks.
đź’ˇSolution: StrongDM ensures compliance with updated guidelines through dynamic password screening and passphrase support, blocking compromised credentials while allowing secure, memorable passwords.
Special Character and Unicode Support
Character set restrictions in passwords have evolved significantly under the new NIST framework. A security implementation study shows that organizations supporting Unicode and extended ASCII characters report 43% fewer password reset requests.
The updated guidelines mandate acceptance of all printable ASCII characters, spaces, and Unicode symbols, including emojis and international characters. By expanding the available options, users are able to create memorable passphrases in their native languages while, at teh same time, adhering to accepted guidelines.
Enterprises that adopt these expanded character set policies need to handle Unicode normalization correctly if they want to avoid authentication headaches. The good news? StrongDM takes care of all that behind the scenes, automatically ensuring passwords work smoothly across systems while keeping everything NIST-compliant.
Password Length vs. Complexity: NIST's New Approach
Why Length Matters More Than Complexity
Modern computing power has fundamentally changed password security dynamics. According to MIT password recommendations, an 8-character password with special characters can be cracked in under an hour, while a 12-character simple phrase requires over 200 years to withstand brute-force attacks using the same resources.
The shift toward length-based security also addresses human behavior patterns. Think of it this way; users tend to create more memorable passwords when they're free from complex requirements, and that reduces risky practices like password reuse and sticky note storage. This alignment of security with user psychology represents a key evolution in authentication strategy.
Recommended Password Length Best Practices
NIST's guidelines establish very clear parameters for password length. The recommendation is a minimum of 8 characters for standard accounts and 15 characters for high-security systems. A large scale study by Georgia Institute of Technology demonstrates that outdated password practices are putting millions at risk.
For maximum security, NIST advocates that passwords be up to 64 characters. Clearly, there are a huge variety of ways this can all be implemented, but StrongDM automatically enforces these length requirements while supporting Unicode characters, making it easier for users to create a longer password that is both memorable and secure.
Security experts say that passwords between 12-16 characters provide the optimal balance between security and usability. Organizations should consider implementing adaptive length requirements based on risk levels, with stricter minimums for privileged accounts and sensitive data access.
The End of Traditional Complexity Rules
By rejecting traditional and long-held complexity requirements, NIST is shaking up all facets of password-related security measures. Mandated special characters and mixed case requirements often lead to predictable patterns like "Password123!" or "Admin2024$", making passwords more vulnerable to attack.
Organizations implementing these updated guidelines can experience a decrease in password resets and improved user satisfaction. The removal of arbitrary complexity rules allows users to create longer, more memorable passwords while maintaining robust security through enhanced screening against compromised credential databases.
đź’ˇSolution: Here again, StrongDM automatically validates passwords against breach databases and supports natural language passphrases, helping organizations transition smoothly to NIST's modernized approach.
Password Management Standards
Password Storage and Encryption
NIST mandates secure password storage through advanced encryption techniques to protect against data breaches. The NIST guidelines require organizations to implement salting and hashing using memory-hard functions, with bcrypt and Argon2 emerging as preferred solutions.
Organizations must store passwords in a form resistant to offline attacks. According to the Federal Information Security Management Act, verifiers need approved encryption and authenticated protected channels when requesting memorized secrets, providing defense against eavesdropping and man-in-the-middle attacks.
đź’ˇSolution: StrongDM automates secure key derivation, encrypts password operations, and prevents vulnerabilities like plain-text password exposure.
Password Reset and Recovery Protocols
Let's look at just how much of a shift this represents. Knowledge-based authentication questions like "first pet" or "mother's maiden name" are no longer considered secure, with most of these answers being discoverable through social media.
Modern recovery protocols must utilize secure channels separate from the primary authentication method. Implementing multi-channel verification leads to a reduction in account takeover incidents. For example, a multi-channel approach mandates verification through separate channels, usually in the form of hardware tokens or biometric authentication.
For enhanced security, NIST goes so far as to recommend the implementation of rate limiting on authentication attempts and enforcing mandatory cooling-off periods after failed recovery attempts. The recommendation is for organizations to establish and manage detailed logs of all password reset activities in an effort to enable rapid response to potential security incidents. Ultimately, this will protect personal information through robust privacy controls.
Service Account Password Guidelines
Service accounts represent a critical vulnerability in enterprise environments. NIST's framework emphasizes rigorous controls for service account passwords, requiring organizations to implement automated rotation schedules and strict access limitations.
Unmanaged service accounts often lead to security breaches in cloud environments. To address this risk, NIST mandates that service account passwords must span at least 32 characters and undergo cryptographic generation through secure random number generators.
đź’ˇSolution: StrongDM automates service account management, enforces password security, and maintains audit trails, ensuring least privilege access and NIST compliance.
NIST Authentication Standards
Multi-Factor Authentication Requirements
NIST's guidelines mandate robust MFA implementation across all privileged access points. According to a recent CISA analysis, organizations must deploy at least two distinct authentication factors from separate categories - something you know (password), have (security token), or are (biometric).
Phishing-resistant MFA could help prevent account compromise attacks. For this reason, NIST specifically prohibits SMS-based authentication for federal systems, requiring verifiers to implement time-based one-time passwords (TOTP) or hardware security keys.
Risk management processes must now include periodic assessment of authentication methods, with organizations required to document their MFA implementation strategy and maintain records of authentication attempts. This approach maps to NIST's broader focus on measurable security outcomes and goes far beyond prescriptive controls.
Biometric Authentication Guidelines
NIST's guidelines establish strict parameters for biometric authentication, requiring a False Match Rate (FMR) of no more than 1 in 10,000 and a False Non-Match Rate (FNMR) below 5%. These standards ensure reliable verification across diverse demographics while maintaining privacy.
NIST mandates that biometric data must be encrypted during capture and immediately deleted after generating cryptographic templates. This "collect-and-delete" approach reduces privacy risks while maintaining authentication effectiveness.
Organizations implementing biometric systems must provide alternative authentication methods for individuals who cannot use the primary biometric modality, ensuring accessibility without compromising security. StrongDM supports these requirements with secure template storage and flexible authentication options.
Password Manager Integration
NIST's guidelines strongly endorse password managers as essential tools for maintaining robust authentication practices. To meet NIST requirements, password managers must implement zero-knowledge encryption and support copy-paste functionality in password fields.
đź’ˇSolution: StrongDM integrates with password managers, enforces NIST-compliant policies, validates credentials, and automates rotation for continuous compliance.
Password Rotation and Expiration Policies
When to Change Passwords
Modern password expiration policies have evolved significantly from traditional calendar-based rotations. According to the Cybersecurity & Infrastructure Security Agency, mandatory periodic password changes often lead to weaker credentials, with users typically making minor modifications to existing passwords. Instead, organizations should implement event-based password changes triggered by specific security incidents.
Companies adopting event-based password policies may experience fewer credential-related breaches compared to those using fixed rotation schedules. This approach aligns with current Digital Identity Guidelines, which recommend password changes in response to compromise indicators rather than arbitrary time periods.
Organizations should enforce immediate password resets when detecting suspicious login attempts, unusual account activity, or potential data breaches. For privileged accounts accessing sensitive systems, implementing automated monitoring tools can help identify these security events and prompt necessary credential updates.
Emergency Password Reset Procedures
Rapid response capabilities for emergency password resets are crucial for maintaining business continuity. According to StrongDM, 64% of organizations have their productivity impacted on a daily or weekly basis due to access and credential issues.
Modern emergency reset protocols must balance speed with security. Implementing a three-tier verification system using trusted devices, backup authentication methods, and manager approval for sensitive accounts may reduce unauthorized reset attempts.
For privileged accounts accessing critical infrastructure, organizations need documented procedures that include IP address verification and out-of-band authentication. A combination of lowercase letters and dictionary words can create temporary credentials that meet NIST guidelines while remaining memorable for urgent situations. StrongDM's infrastructure access platform automates these processes, ensuring every client maintains security even during emergencies.
Breach Response Protocol
Effective breach response protocols require immediate action when credentials are compromised. Organizations that detect and respond to breaches within 24 hours can substantially reduce credential abuse.
Organizations must maintain an incident response playbook that includes automatic credential invalidation, system-wide password resets, and user notification procedures. Implementing parallel authentication channels during breach recovery can help maintain business continuity while compromised credentials are being addressed.
đź’ˇSolution: StrongDM automates breach response by revoking compromised credentials, enforcing NIST-compliant passwords, and using real-time monitoring for targeted mitigation.
Implementing NIST Password Guidelines
Creating a Password Policy
Developing an effective password policy requires balancing security requirements with operational needs. Organizations that align their password policies with NIST guidelines can see a reduction in password-related security incidents.
Start by defining clear objectives and scope, including which systems and user groups the policy will cover. Then, document specific requirements for different account types, from standard users to privileged administrators. Consider environmental factors like remote work and third-party access when establishing policy parameters.
Your policy should address password creation, storage, and lifecycle management while incorporating NIST's emphasis on length over complexity. StrongDM's infrastructure access platform helps automate policy enforcement through customizable rules that adapt to your organization's specific needs and risk profile.
Training and User Education
Effective password security hinges on comprehensive user education. Organizations with robust training programs experience fewer password-related incidents.
Beyond traditional training methods, gamification has emerged as a powerful educational tool. Interactive password security modules increase retention rates compared to conventional presentations. Organizations should incorporate scenario-based exercises that simulate real-world password threats while teaching NIST-compliant practices.
Regular reinforcement through microlearning sessions keeps password security top of mind without overwhelming users. Short, focused training delivered through mobile apps or email reminders has proven particularly effective for remote workforces, reducing password reset requests.
Compliance Monitoring
Maintaining continuous NIST password compliance requires robust monitoring systems and regular audits. Organizations with automated compliance monitoring can detect password policy violations within hours rather than days or weeks.
Real-time monitoring should track key metrics like failed authentication attempts, password reset patterns, and credential sharing incidents. Automated scanners that check password hashes against known breach databases should also be implemented to monitor for compliance drift.
đź’ˇSolution: StrongDM's infrastructure access platform streamlines this process by providing detailed audit logs and real-time compliance alerts across your entire authentication ecosystem.
Common Implementation Challenges
Legacy System Integration
Integrating NIST password guidelines with legacy systems presents unique technical hurdles. According to NIST's Digital Transformation Guide, organizations often struggle with outdated authentication protocols that don't support modern password requirements.
Some enterprises still maintain legacy systems unable to handle extended character limits or implement proper password hashing. These systems may lack support for Transport Layer Security (TLS) 1.3 or newer encryption standards essential for NIST compliance.
To bridge this gap, organizations can implement middleware solutions that translate between modern and legacy authentication protocols. For critical systems that cannot be directly upgraded, deploying password vaults and privileged access gateways helps maintain security while working within technical constraints.
User Adoption Barriers
User resistance to new password guidelines stems from deeply ingrained habits and behavioral patterns. Employees often view password policy changes as disrupting their workflow, while security fatigue leads to non-compliance.
Users struggle with memorizing multiple complex passwords, leading to risky workarounds like password recycling or unauthorized storage methods.
đź’ˇSolution: StrongDM simplifies adoption with intuitive interfaces and gradual implementation, aligning with user behavior while ensuring NIST compliance and reducing resistance.
Technical Limitations
Hardware constraints pose significant challenges for NIST password implementation. Authentication systems often struggle with memory-hard hashing functions required by NIST, particularly in embedded systems and IoT devices.
Storage requirements for proper password salting and hashing create bottlenecks in resource-constrained environments. Implementing PBKDF2 with the recommended 310,000 iterations demands substantial CPU resources, impacting system performance on legacy hardware.
Rate-limiting mechanisms, essential for preventing brute-force attacks, can strain network infrastructure when handling high-volume authentication requests. Organizations must carefully balance security requirements with system capabilities, often requiring significant infrastructure upgrades to maintain NIST compliance while ensuring acceptable performance levels.
How StrongDM Helps Meet NIST Password Standards
StrongDM delivers comprehensive NIST password compliance through our infrastructure access platform. Organizations using integrated access solutions can achieve higher NIST compliance rates. Our platform automates password validation against NIST's latest requirements while providing real-time monitoring of authentication patterns.
StrongDM validates every authentication attempt against current NIST standards, helping organizations maintain robust security without compromising user experience or operational efficiency.
Ready to see how it works? Schedule a demo today and discover how StrongDM can help your organization stay secure and compliant effortlessly.
Next Steps
StrongDM unifies access management across databases, servers, clusters, and more—for IT, security, and DevOps teams.
- Learn how StrongDM works
- Book a personalized demo
- Start your free StrongDM trial
Categories:
About the Author
John Martinez, Technical Evangelist, has had a long 30+ year career in systems engineering and architecture, but has spent the last 13+ years working on the Cloud, and specifically, Cloud Security. He's currently the Technical Evangelist at StrongDM, taking the message of Zero Trust Privileged Access Management (PAM) to the world. As a practitioner, he architected and created cloud automation, DevOps, and security and compliance solutions at Netflix and Adobe. He worked closely with customers at Evident.io, where he was telling the world about how cloud security should be done at conferences, meetups and customer sessions. Before coming to StrongDM, he lead an innovations and solutions team at Palo Alto Networks, working across many of the company's security products.
More Glossary Terms
Access control lists (ACL) control or restrict the flow of traffic through a digital environment. ACL rules grant or deny access in two general...
In October 2023, Ace Hardware, one of the largest hardware retailers in the United States, experienced a cybersecurity incident that overwhelmed several...
What is Active Directory (AD) Bridging? Active Directory Bridging is a technology in the field of networking that aims to enhance the communication...
Active Directory (AD) is a critical component for Windows based networks. It is a centralized authentication and authorization service that helps...
Active Directory (AD) is Microsoft’s proprietary directory service for Windows domain networks. Active Directory authentication is AD’s system for...
Advanced threat protection is a type of cybersecurity dedicated to preventing pre-planned cyberattacks, such as malware or phishing. ATP combines cloud,...
Agentless monitoring is a form of IT monitoring that does not require the installation of a software agent. Agentless monitoring protocols or APIs collect...
Amazon hacked! That was big news for the better part of November 2024 after the online retail giant confirmed that employee data had been leaked due to...
In January and February 2024, American Express notified customers of several third-party data breaches impacting client account numbers. The data breaches...
What Is Anomaly Detection? Anomaly detection is the process of analyzing company data to find data points that don’t align with a company's standard data...
What is an Application Gateway (App Gateway)?An application gateway is a security measure that protects web applications. They replace traditional web...
On Nov. 3, 2023, a ransomware gang hacked into a Bank of America service provider's systems. The data breach exposed the personal information of more than...
Your organization's attack surface is a collection of all the external points where someone could infiltrate your corporate network. Think of your attack...
As more and more data and critical systems go online, the risks associated with cyber threats magnify. One of the most important aspects of cybersecurity...
Authentication is the process of verifying a user or device before allowing access to a system or resources.
An authentication bypass vulnerability is a weak point in the user authentication process. A cybercriminal exploiting such a weakness circumvents...
When it comes to protecting sensitive data and ensuring systems security, two key concepts come into play - authentication and authorization. Although...
Amazon Web Services (AWS) has emerged as one of the leading providers of cloud computing services, providing a wide range of management tools for...
The difference between an IAM role and a user is that a role can be temporarily or permanently applied to a user to give the user bulk permissions for a...
Understanding NoSQL Databases Before we take a closer look at the various NoSQL databases provided by AWS, let's first understand what NoSQL databases...
On Nov. 3, 2023, a ransomware gang hacked into a Bank of America service provider's systems. The data breach exposed the personal information of more than...
A bastion host is a server used to manage access to an internal or private network from an external network - sometimes called a jump box or jump server.
Behavior-Based Access Control (BBAC) is a security model that grants or denies access to resources based on the observed behavior of users or entities. It...
A brute force attack is a cyber attack where a hacker guesses information, such as usernames and passwords, to access a private system. The hacker uses...
Software or hardware that is either hosted in the cloud or on-premises. It adds a layer of security between users and cloud service providers and often...
Employer-employee relationships don’t always end well. Terminations, even rightful ones, leave a bad taste in the recipient's mouth — in some cases, so...
Charles Schwab, a behemoth in the brokerage and financial services space, fell prey to a well-orchestrated data breach in mid-2023. In a devastating spree...
In February 2024, JPMorgan Chase reported that it discovered a data breach affecting the personal information of nearly half a million customers....
On November 8, 2023, hackers under the username DrOne leaked a database containing the personal information of over 800,000 Chess.com users. While it...
CI/CD (continuous integration/continuous deployment) is a collection of practices for engineering, testing, and delivering software. A CI/CD pipeline is...
A June 2024 letter posted on the state of Massachusetts website revealed that Citibank experienced a data breach last year. According to the notification...
What is Cloud Application Security? Cloud application security is a crucial aspect of modern business operations, especially as more organizations turn...
Cloud Infrastructure Entitlement Management (CIEM, pronounced “kim”) is a category of specialized software-as-a-service solutions that automate the...
What is Cloud Workload Security?Cloud workload security is the practice of securing applications and their composite workloads running in the cloud....
Input/Output (IO) is a fundamental aspect of modern computing systems. In order to effectively send and receive data between a computer and its...
Container orchestration platforms are becoming increasingly popular with developers and businesses alike. They provide a way to manage and automate the...
In today's ever-evolving threat landscape, businesses must remain vigilant in defending their networks against potential attacks. As a result, Managed...
Software-Defined Networking (SDN) and Network Functions Virtualization (NFV) are two terms that frequently come up in discussions of modern networking....
In the ever-changing technology landscape, software-defined networking (SDN) and software-defined wide area network (SD-WAN) are two buzzwords that have...
In the realm of software development, there are two popular approaches to managing complex systems: Site Reliability Engineering (SRE) and DevOps. While...
As we continue to combat the increase in cybersecurity threats, it’s essential that businesses have a comprehensive plan in place to protect their assets....
Continuous Adaptive Risk and Trust Assessment (CARTA) is an IT security framework that goes beyond traditional role-based access control (RBAC). By adding...
Credential stuffing is a type of cyber attack that occurs when a person or bot steals account credentials, such as usernames and passwords, and tries to...
Online security risks are a constantly evolving concern. As we increasingly rely on digital platforms for everything from communication to banking and...
Cyber insurance, also called cybersecurity insurance or cyber liability insurance, is an insurance policy that covers the losses a business might suffer...
Data Loss Prevention (DLP) is a series of tools and practices that help companies recognize and prevent data exposure by controlling the flow of...
Data observability is the ability to understand, diagnose, and manage data health across multiple IT tools throughout the data lifecycle. A data...
Data Security Posture Management (DSPM) refers to the proactive and continuous assessment, monitoring, and enhancement of an organization's data security...
What is Defense-in-depth?Defense-in-depth began as a military term for a layered approach to protection. The NSA has taken that military strategy and...
In today's fast-paced business world, technology and software development have become crucial for organizations to stay ahead of the competition. With...
Digital Forensics and Incident Response (DFIR) is a cybersecurity practice for identifying, investigating, and remediating cyberattacks. Computer security...
What Are Directory Services? A directory service is a database containing information about users, devices, and resources. This information, such as...
In March 2023, Discord, one of the world's most popular communication platforms among online communities, suffered a breach that impacted nearly 200 user...
What is Dynamic Access Control (DAC)? Dynamic Access Control (DAC) is a Windows Server feature that debuted in Windows Server 2012. It leverages...
In today's world, cyber threats are becoming more sophisticated, and even the most robust security measures cannot guarantee total protection. As a...
What is Endpoint Privilege Management (EPM)? Endpoint Privilege Management (EPM) is a critical process that ensures that users and applications have...
An enterprise Kubernetes (K8s) platform packages Kubernetes—an open source container orchestrator—into a simple-to-use product for companies. Container...
What is Enterprise Password Management? Enterprise Password Management is a system or software designed to securely store, manage, and control access to...
An ephemeral environment is a short-lived clone of the UAT (user acceptance testing) or production environment. Software teams create ephemeral...
In March 2017, unfortunate events allowed hackers to access the personal information of millions of Equifax customers. The intruders stayed active in...
The Experian data breach proves that no organization is too big for attackers to target. Actually, when you look at it, the bigger the organization, the...
Eye4Fraud provides fraud protection services for online sellers. It examines their transactions to ensure every order is legitimate. Unfortunately, even a...
In April 2021, Facebook experienced a data leak. Cybercriminals accessed personal information belonging to more than half a million Facebook users and...
Single sign-on (SSO) and federated identity management (FIM) are two popular methods of identity management that are commonly used to simplify...
In August 2024, one of the largest asset managers, Fidelity Management & Research, fell victim to a data breach. This lasted for two days until the firm...
FIDO2 is the newest set of specifications from the FIDO Alliance. It enables the use of common devices to authenticate to online services on both mobile...
In 2018, Google, one of the world's largest tech companies, was at the center of major privacy concerns when it disclosed a data breach that had exposed...
Compliance with the Health Insurance Portability and Accountability Act (HIPAA) means adhering to the rules and regulations that impact what, how, and...
HITRUST is a non-profit company that delivers data protection standards and certification programs to help organizations safeguard sensitive information,...
A honeypot is a phony digital asset designed to look like a poorly-guarded, valuable asset. The goal is to trick cyber attackers into targeting the...
Identity and access management (IAM or IdAM) is a framework containing the tools and policies a company uses to verify a user’s identity, authorize...
Identity as a Service (IDaaS) is an identity and access management (IAM) solution delivered in a cloud-based service that is hosted by a trusted third...
Identity governance and administration (IGA), also called identity security, is a set of policies that allow firms to mitigate cyber risk and comply with...
What is Identity Lifecycle Management? Identity lifecycle management is the process of managing user identities and access privileges for all members of...
Identity security refers to the tools and processes intended to secure identities within an organization. Based upon the Zero Trust model, identity...
What is Identity Threat Detection and Response (ITDR)? Identity Threat Detection and Response (ITDR) refers to a range of tools and processes designed to...
While there's an overlap between IGA and IAM, key differences distinguish the two. IAM focuses on authenticating and authorizing user access, primarily...
An indicator of attack (IOA) is digital or physical evidence of a cyberattacker’s intent to attack. IOA detection focuses specifically on an adversary’s...
An insider threat is a threat to an organization that occurs when a person with authorized access—such as an employee, contractor, or business...
ISO/IEC 27001, or ISO 27001, is the international standard that defines best practices for implementing and managing information security controls within...
ISO 27002, or ISO/IEC 27002:2022, provides guidance on the selection, implementation, and management of security controls based on an organization's...
ISO 27003, also called ISO/IEC 27003:2017, provides guidance for implementing an ISMS based on ISO 27001.
Just-in-time (JIT) access is a feature of privileged access management (PAM) solutions to grant users access to accounts and resources for a limited time...
Kubernetes governance refers to the policies and procedures for managing Kubernetes in an organization. Governance applies to technical units (such as...
Lateral movement is when an attacker gains initial access to one part of a network and then attempts to move deeper into the rest of the network —...
Lightweight directory access protocol (LDAP) is an open-standard and vendor-agnostic application protocol for both verifying users' identities and giving...
The real estate sector has experienced a spate of shocking cyber incidents in recent times. But few have been as devastating as the LoanDepot data breach....
Log analysis is the practice of examining event logs in order to investigate bugs, security risks, or other issues. Analyzing automatically generated log...
Log data—from system, application, and security log files, for example—help IT staff identify technical issues, troubleshoot, improve performance, and...
A man-in-the-middle (MITM) attack is a cyber attack in which a threat actor puts themselves in the middle of two parties, typically a user and an...
In September 2018, Marriott International uncovered unauthorized access to its Starwood brand reservation database—an incident that ultimately became one...
Microsegmentation is a network security practice that creates secure zones within data center environments by segmenting application workloads into...
Hardly a year passes without a "Microsoft hacked" story hitting the headlines. In their frequency and sophistication, these incidents highlight a widely...
Monitoring is the collection and analysis of data pulled from IT systems. DevOps monitoring uses dashboards— often developed by your internal team—to...
On Oct. 31, 2023, Mr. Cooper Group, a leading non-bank mortgage loan servicer, experienced a large-scale data breach. An unauthorized third party gained...
When word got out about the National Public Data breach, the world went into a frenzy. Why? National Public Data (NPD) handled billions of personal data...
Network segmentation (also known as network partitioning or network isolation) is the practice of dividing a computer network into multiple subnetworks in...
NIST compliance broadly means adhering to the NIST security standards and best practices set forth by the government agency for the protection of data...
Observability is defined as a measure of how well the internal states of a system can be inferred from knowledge of its external outputs.
OAuth (OAuth 2.0 since 2013) is an authentication standard that allows a resource owner logged-in to one system to delegate limited access to protected...
OpenID Connect (OIDC) is an authentication layer built on top of the OAuth 2.0 authorization framework. OIDC allows third-party applications to obtain...
In February 2024, a ransomware gang hacked into Change Healthcare systems, a subsidiary of UnitedHealth’s Optum. The data breach compromised the personal...
The Organization for the Advancement of Structured Information Standards (OASIS) is a non-profit consortium that develops and promotes open standards for...
What is Pass-the-Hash (PtH) Attack? Pass-the-hash (PtH) attacks are a type of network attack that involves stealing hashed credentials from one computer...
What is Password Rotation? Password rotation is a security practice that involves changing passwords regularly to prevent unauthorized access to personal...
What is Password Vaulting? Password vaulting is a technique used to store passwords in a central location and protect them with encryption. The primary...
Passwordless authentication is a verification method in which a user gains access to a network, application, or other system without a knowledge-based...
Hackers accessed thousands of PayPal user accounts between Dec. 6 and Dec. 8, 2022. The attack exposed customers' personal information, opening them up to...
PCI compliance—or payment card industry compliance—is the process businesses follow to meet the Payment Card Industry Data Security Standard (PCI DSS).
A Policy Decision Point (PDP) is a component in a system that makes decisions based on policies that have been defined within that system. It is a crucial...
Policy-Based Access Control (PBAC) is another access management strategy that focuses on authorization. Whereas RBAC restricts user access based on static...
‍In network security, least privilege is the practice of restricting account creation and permission levels to only the resources a user requires to...
Privileged access management (PAM) encompasses the policies, strategies, and technologies used to control, monitor, and secure elevated access to critical...
Cloud privileged access management is cloud-based PAM consumed as a service, or PAMaaS. Companies can replace their on-premises PAM technology with a...
A privileged account is a user account with greater privileges than those of ordinary user accounts. Privileged accounts may access important data or...
What is Privileged Session Management? Privileged session management (PSM) is an IT security process that monitors and records the sessions of privileged...
Cloud computing has revolutionized the way businesses and organizations operate, allowing them to store, access, and manage data and applications in...
A Rainbow Table Attack is a cryptographic attack method that uses precomputed tables of hash values to quickly reverse-engineer plaintext passwords from...
“Red team vs. blue team” is a cybersecurity drill during which one group, dubbed the “red team,” simulates the activities of cyberattackers. A separate...
ReBAC is a model that extends the traditional Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) models by considering the...
What is Remote Access Security? Remote access is the ability to access resources, data, and applications on a network from a location other than the...
Remote code execution (RCE) is a cyberattack in which an attacker remotely executes commands to place malicious code on a computing device. Input or...
With the increase in online traffic and the need for secure and fast network connections, reverse proxies and load balancers have become integral...
What is Robotic Process Automation (RPA) Security? Robotic process automation (RPA) is software that mimics human actions to automate digital tasks....
Role-based access control (RBAC) is a security approach that authorizes and restricts system access to users based on their role(s) within an organization.
Imagine this: Your organization experiences a data breach, yet things continue to run as usual. You don’t experience interruptions, and your partners and...
SAML is a popular online security protocol that verifies a user’s identity and privileges. It enables single sign-on (SSO), allowing users to access...
SAML enables SSO by defining how organizations can offer both authentication and authorization services as part of their infrastructure access strategy....
Many businesses have traditionally relied on Multiprotocol Label Switching (MPLS) networks to connect their remote sites and branch offices. However,...
Secrets management is a cybersecurity best practice for securing digital authentication credentials. It relies on various tools and methods to store,...
Secure Access Service Edge (more commonly known by the SASE acronym) is a cloud architecture model that combines network and security-as-a-service...
A Security Incident Response Policy (SIRP) establishes that your organization has the necessary controls to detect security vulnerabilities and incidents,...
Separation of duties (SoD) is the division of tasks among organization members to prevent abuse, fraud, or security breaches. SoD encompasses a set of...
What is Shadow IT? Shadow IT is software or hardware in use in an organization without the knowledge of the IT department. Business units or individuals...
Shoulder surfing is a form of social engineering where an attacker obtains sensitive information by observing the victim's screen or keyboard inputs,...
Businesses operate in a data-driven world, handling data for different purposes. As more data is generated, companies seek ways to organize and manage...
Single-factor authentication (SFA) or one-factor authentication involves matching one credential to gain access to a system (i.e., a username and a...
Snowflake hacked! Yes, those were the headlines going around for the better part of April to July 2024. What started as a “small breach” eventually...
When it comes to modern software development, two terms that are often used interchangeably are Service-Oriented Architecture (SOA) and Microservices....
SOC 2 stands for “Systems and Organizations Controls 2” and is sometimes referred to as SOC II. It is a framework designed to help software vendors and...
With a software-defined network, networking devices directly connect to applications through application programming interfaces (APIs), making SDN...
In April 2011, Sony experienced one of the most notorious data breaches in history when hackers infiltrated the PlayStation Network (PSN). This...
SOX compliance is an annual obligation derived from the Sarbanes-Oxley Act (SOX) that requires publicly traded companies doing business in the U.S. to...
In today's digital age, many individuals and organizations rely on technology for communication, transactions, and data storage. However, with this...
Even the best security practices can’t always protect you from one major risk: third parties. A single weak link—whether a vendor, partner, or service...
In today's digital age, there are many cybercrimes that individuals and organizations need to be aware of. Two of the most common cybercrimes are spoofing...
Understanding SQL and NoSQL Databases When it comes to managing data, there are two main types of databases: SQL and NoSQL. While both types of databases...
While T-Mobile has experienced several other breaches in past years, this article will focus on the latest one: The 2021 T-Mobile data breach took place...
A single weak link — whether it's a service provider, vendor, or partner — can put your entire organization at risk. Just ask Target: In December 2013,...
Technical debt is any software code which achieves a short-term goal at the cost of some future drawback. It commonly takes the form of code that...
Derived from the Greek roots tele ("remote") and metron ("measure”), telemetry is the process by which data is gathered from across disparate systems to...
What Is a Threat Actor? A threat actor is any individual or group that has the intent and capability to exploit vulnerabilities in computer systems,...
Threat hunting is the cyber defense practice of proactively searching for threats within a network. Threat hunters look for threats that may have evaded...
The ultimate findings from cyberthreat analyses are referred to as threat intelligence. Producing threat intelligence involves a cycle of collecting data...
The Ticketmaster data breach is a classic case of just how much third parties can put your organization at risk of cyberattacks. In May 2024,...
In October 2023, Truist Bank suffered a cybersecurity event that exposed the private information of its employees. The hacker group responsible for the...
Two-factor authentication (2FA) adds a second layer of protection to your access points. Instead of just one authentication factor, 2FA requires two...
In the world of web development, CRUD and REST are two terms that are frequently used, but often misunderstood. While both are important and have their...
On February 21, 2024, United Healthcare was hacked in a ransomware data breach that impacted its Change Healthcare (CHC) unit. The data breach affected...
The United Services Automobile Association (USAA) has experienced several data breaches in the last few years. Most recently, in August 2024, USAA sent a...
In January 2024, a massive cybersecurity event that left 26 million records exposed affected the mobile payment service Venmo. Dubbed the "mother of all...
In February 2019, two security researchers identified a massive data leak in a database belonging to Verifications.io, an email validation service...
Vulnerability management (VM) is the proactive, cyclical practice of identifying and fixing security gaps. It typically leverages scanning software to...
What is a Vulnerability Management Lifecycle? The vulnerability management lifecycle involves continuous monitoring and assessment of systems, regular...
In April 2024, Walmart’s retirement plan administrator, Merrill Lynch, experienced a security incident that revealed how even small internal oversights...
WebAuthn is the API standard that allows servers, applications, websites, and other systems to manage and verify registered users with passwordless...
In June 2023, Wells Fargo reported a security incident caused by an employee mishandling customer information in violation of company policy. In response,...
A non-human identity is any digital credential not tied to a person. It’s what allows systems to communicate with each other securely, without human...
A human firewall refers to employees trained to recognize and prevent cyber threats, such as phishing attacks and malware. By fostering cybersecurity...
A Policy Administration Point (PAP) is a crucial component in access control systems, responsible for defining and managing policies that regulate user...
A Policy Enforcement Point (PEP) is a component in a security framework that enforces access control policies. It regulates and monitors access to...
A policy engine is a software component that allows an organization to manage, enforce, and audit rules across their system. It is designed to provide a...
A Policy Enforcement Point (PEP) is a component in a security framework that enforces access control policies. It regulates and monitors access to...
Access Discovery is the process of identifying and verifying available pathways to digital resources or information within a system or network. It...
Active Directory (AD) bridging lets users log into non-Windows systems with their Microsoft Active Directory account credentials. This extends AD benefits...
Open Policy Agent (OPA) is an open-source, general-purpose policy engine that enables policy-as-code across diverse software stacks. It provides a unified...
Continuous Authorization is a security concept ensuring ongoing validation of users' access rights within a system. Employing real-time session monitoring...
What is Continuous Monitoring? Continuous monitoring is a systematic and ongoing process that uses automated tools and technologies to monitor the...
Customer Identity Access Management (CIAM) is a specialized branch of identity and access management designed to facilitate secure and seamless customer...
Threat hunting is the cyber defense practice of proactively searching for threats within a network. Threat hunters look for threats that may have evaded...
Deprovisioning removes the access rights and deletes the accounts associated with a user on a network. When an organization offboards an individual, it’s...
Disaster Recovery Policy is a strategic framework outlining procedures and resources to swiftly restore essential business functions after a disruptive...
eXtensible Access Control Markup Language (XACML) is a standard for specifying and exchanging access control policies in computer systems. It provides a...
Fine-grain access controls are a type of access control that enables granular access to systems, applications, and data. Access is based on specific...
Group-Based Access Control (GBAC) is a security model that regulates access to resources by assigning permissions based on user group membership. It...
Identity Fabric refers to an integrated set of identity and access management services that provide seamless and secure user access across a diverse range...
Kerberoasting is a post-compromise attack technique for cracking passwords associated with service accounts in Microsoft Active Directory. The attacker...
What is NoSQL Injection? NoSQL Injection is a type of injection attack that exploits vulnerabilities in NoSQL databases by injecting malicious code into...
A One-Time Password (OTP) is a security feature that generates a unique, temporary password for a single transaction or login session. Unlike static...
Policy-as-Code refers to the practice of managing and implementing policy decisions through code, making them enforceable and verifiable within IT...
Privileged identity management is the process companies use to manage which privileged users—including human users and machine users—have access to which...
What is Remote Desktop Protocol (RDP)? Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft that allows users to remotely...
Segregation of Duties (SoD) is a risk management principle that ensures critical tasks are divided among different individuals to prevent conflicts of...
Vendor Privileged Access Management (VPAM) is a cybersecurity strategy that focuses on controlling and securing third-party access to an organization's...
Zero Trust Data Protection is a security framework that assumes no inherent trust, requiring verification from anyone trying to access data, regardless of...
X11 Forwarding is a feature of the X Window System that allows a user to run graphical applications on a remote server while displaying them locally. This...
The 2013 Yahoo data breach is a classic case of how security flaws and weak encryption can expose your business to cyber threats. In August 2013, a group...
Zero Trust is a modern security model founded on the design principle “Never trust, always verify.” It requires all devices and users, regardless of...
As cyber attacks become more advanced and frequent, organizations are realizing the importance of enhancing their cybersecurity strategies. Two approaches...
Zombie accounts: forgotten accounts that open the door to bad actors looking to insert malware, steal data, and damage your internal systems.
