The evolving threat landscape

In the past, the perimeter network was considered the largest attack surface for organisations. Well-configured firewalls used to sufficiently secure a network, and threat actors would spend their time sending empty handshakes to every port in an intelligence gathering process known as enumeration. However, with the rapid evolution of cyber threats, humans have proven themselves to be weakest barrier to entry and Identity and Access Management (IAM) has now become the primary target.

The shift towards remote work and cloud services has further expanded this attack surface, making traditional perimeter defences less effective. In this changing landscape, Identity and Access Management has become the frontline in the battle against cyber threats, with a focus on securing user identities and access to critical systems.

Cybercriminals have quickly adapted, employing advanced techniques such as spear phishing, social engineering, and credential stuffing to breach defences and gain unauthorised access to sensitive information. Modern security frameworks developed to address these issues such as the Zero Trust model, relying on the principles of Just In Time (JIT) and Just Enough Access (JEA), can only do so much to reduce the risk of credential compromise and secure an organisation’s network.

Despite the implementation of sophisticated security measures, the human tendency to create “elephant paths”, take shortcuts and prioritise convenience over security makes people the prime target for cyber-attacks. This inherent flaw in human nature is exploited by attackers who understand that the easiest way to breach a system is often through its users. The reliance on passwords, which are frequently reused across multiple accounts and easily guessed, further exacerbates this issue. As a result, humans remain the weakest link in the security chain, and their own desire for convenience undermines even the most robust security frameworks.

Changing guidelines for authentication and lifecycle management

Previously, NIST Special Publication 800-63-2B Digital Identity Guidelines recommended rotating passwords at least once a year to minimise the risk of exposure from leaked credentials. However, advancements in technology, such as Microsoft Identity Protection, now monitor the deep, dark, and surface webs for leaked credentials, lessening the need for password rotations and facilitating recent changes in guidelines.

NIST’s latest amendments in Special Publication 800-63-3B Authentication and Lifecycle Management Guidelines now recommend against organisations imposing mandatory password rotations unless there is a credible risk of credential leakage. This shift reflects the evolving understanding of password security and the importance of balancing security with user convenience. Continuous monitoring and adaptive authentication methods are now preferred, as they provide real-time protection without the need for frequent password changes.

Passphrases and their protection against common attack methods

Passphrases provide additional protection against common attack methods such as brute-force and dictionary attacks. A dictionary attack involves using a precompiled list of words to guess passwords, often sourced from leaked password databases such as the infamous rockyou.txt containing the plaintext passwords of 32 million users exposed in a data breach from 2009. Due to it’s popularity amongst enthusiasts, professionals and cybercriminals alike, rockyou.txt has been continuously updated to include passwords leaked in all further data breaches, with rockyou2024.txt containing over 10 billion unique passwords. Your password is likely included in this wordlist, check for yourself using haveibeenpwned.com/Passwords to see if your password has ever been leaked in a data breach.

Other brute-force attacks involve wordlists generated on demand by programs such as John The Ripper, using basic information about the target like their name, birthday or company, to instantly generate thousands of variations of possible passwords based off the targets personal information. These types attacks exploit the tendency of users to choose simple, common words as passwords.

Passphrases mitigate this attack method by combining multiple words into a single, longer phrase. The increased length and complexity makes it significantly harder for attackers to guess the passphrase using dictionary attacks and programmatically generated wordlists. For example, a passphrase like “YellowLampBathroomMug” is much more secure than a single word like “P@55w0Rd”, passphrases should also include spaces and special characters, further enhancing their security through introducing more entropy.

The importance of entropy

A key component of password strength is the level of entropy, or randomness, added to the password. Entropy measures the unpredictability of a password and is crucial in password security because it determines how resistant a password is to various attack methods.

Higher entropy means more possible combinations, making it exponentially more difficult for attackers to guess or crack through brute-force methods. Research shows that password length is the primary factor in it’s security, as the concept of password complexity is only complex to humans, while password cracking algorithms experience no difficulty iterating through all possible variations of short passwords. For instance, a password with 20 bits of entropy might be cracked in minutes, while one with 60 bits of entropy could take centuries.