3.1 Password Hygiene and Authentication

Weak authentication remains one of the most common root causes of corporate breaches.
Modern security standards focus on usability, strength, and layered protection.

    • The “Passphrase” Standard:
      The NIST (National Institute of Standards and Technology) now recommends
      length over complexity.
      A 15-character passphrase such as Purple-Coffee-Train-Jump is mathematically harder to crack—and easier to remember—than
      Tr0ub4dor&3

    • Credential Stuffing:
      Users frequently reuse passwords across multiple platforms.
      If a service like LinkedIn is breached, attackers automatically test the same credentials on Salesforce,Office 365,and Bankingsystems.

      Rule: Never reuse corporate credentials.

  • MFA (Multi-Factor Authentication):
    This control is non-negotiable in modern security environments.
    MFA blocks approximately 99.9% of automated attacks.
    However, users must be aware of MFA Fatigue,
    where attackers repeatedly send push notifications hoping the victim
    will approve a request just to make it stop.
PreviousNext