3.1 Password Hygiene and Authentication

Weak authentication remains one of the most common root causes of corporate breaches.
Modern security standards focus on usability, strength, and layered protection.

• • The “Passphrase” Standard:
    The NIST (National Institute of Standards and Technology) now recommends
    length over complexity.
    A 15-character passphrase such as Purple-Coffee-Train-Jump is mathematically harder to crack—and easier to remember—than
    Tr0ub4dor&3
    

• • Credential Stuffing:
    Users frequently reuse passwords across multiple platforms.
    If a service like LinkedIn is breached, attackers automatically test the same credentials on Salesforce,Office 365,and Bankingsystems.

    Rule: Never reuse corporate credentials.

• MFA (Multi-Factor Authentication):
  This control is non-negotiable in modern security environments.
  MFA blocks approximately 99.9% of automated attacks.
  However, users must be aware of MFA Fatigue,
  where attackers repeatedly send push notifications hoping the victim
  will approve a request just to make it stop.