diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The new updates offer some reversals and clarifications worth paying attention to.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>What are the NIST Password Guidelines?</strong><br> 
  The NIST Password Guidelines are also known as <a href="https://pages.nist.gov/800-63-3/sp800-63-3.html">NIST Special Publication 800-63B</a> and are part of the NIST’s digital identity guidelines. They were originally published in 2017 and most recently updated in March of 2020 under” Revision 3 “or” SP800-63B-3. They are considered the most influential standard for password creation and use policies by many <a href="http://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf"> password cracking experts</a>.<br> 
</div>

According to the Verizon Data Breach Investigations Report, compromised passwords are responsible for [81% of hacking-related breaches](https://enterprise.verizon.com/resources/reports/dbir/). Needless to say, a key part of overall information security is securing your users’ passwords.

However, while there are a lot of conventional password security practices that seem intuitive, a lot of them are misleading, outdated, and even counterproductive.

That’s where the National Institute of Standards and Technology (NIST) password guidelines (also known as [NIST Special Publication 800-63B](https://pages.nist.gov/800-63-3/sp800-63-3.html)) come in. Although they’re required only for federal agencies, they’re considered the gold standard for password security by [many experts](http://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf) because of how well researched, vetted, and widely applicable they are for the private sector.

In fact, many [corporate security teams are already using the NIST password guidelines](https://venturebeat.com/2017/04/18/new-password-guidelines-say-everything-we-thought-about-passwords-is-wrong/) as a baseline to provide something even more powerful than policies: credibility. So if you’re looking for what actually works for password security in 2020, here’s what the NIST says you should be doing (in plain English).

## New Password Creation Guidelines

Password security starts with the physical creation of that password. However, it’s not just your users’ responsibility to ensure their passwords are up to par &mdash; it’s also up to you to ensure that the passwords are strong enough (especially in light of how [the FTC handled the TaxSlayer case](https://biglawbusiness.com/cybersecurity-enforcers-wake-up-to-unauthorized-computer-access-via-credential-stuffing/)).

Here’s what the NIST guidelines say you should include in your new password policy.

### 1. Length > Complexity

Conventional wisdom says that a complex password is more secure. But in reality, password length is a much more important factor because a longer password is harder to decrypt if stolen.

Here’s a great example of how password length benefits you more than complexity on a technical level:

![Complexity of Passwords](https://images.ctfassets.net/23aumh6u8s0i/7zLMdDrj4rEC2IBL5BR2sN/cfc2a70bfbf520f7b439685894975a6c/passwords)
<p align="center">This is why <b>the NIST guidelines call for a strict eight-character minimum length.</b></p>

However, additional research shows that requiring new passwords to include a certain amount of complexity can actually make them less secure. And that’s why NIST has also removed all password-complexity requirements from their guidelines.

For example, many companies require that users include special characters, like a number, symbol, or uppercase letter, in their passwords to make them harder to decrypt. 

Unfortunately, many users will add complexity to their password by simply capitalizing the first letter of their password or adding a “1” or “!” to the end. And while it technically does make a password more difficult to crack, most password-crackers worth their salt know users tend to follow these patterns and can use them to reduce the time needed to decrypt a stolen password. 

Additionally, as password complexity increases, users tend to reuse passwords from account to account, increasing the risk that they could be the victim of a [credential stuffing attack](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/) if one account is breached. 

So instead of forcing users to create more complex passwords, ask them to create longer ones if you want to improve password security.

### 2. Eliminate Periodic Resets

Many companies ask their users to reset their passwords every few months, thinking that any unauthorized person who obtained a user’s password will soon be locked out. However, frequent password changes can actually make security worse.

It’s difficult enough to remember one good password a year. And since users often have numerous passwords to remember already, they often resort to [changing their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die), such as adding a single character to the end of their last password or replacing a letter with a symbol that looks like it (such as $ instead of S).

So if an attacker already knows a user’s previous password, it won’t be difficult to crack the new one. The NIST guidelines state that periodic password-change requirements should be removed for this reason.

## Password Authentication Guidelines

The way you authenticate a password when a user logs in can have a massive impact on everything related to password security (including password creation). Here is what NIST recommends regarding the actual input and verification of passwords.

### 1. Enable “Show Password While Typing”

Typos are common when entering passwords, and when characters turn into dots as soon as they’re typed, it’s difficult to tell where you went wrong. This motivates users to pick shorter passwords that they’re less likely to mess up, especially on sites that allow only a few login attempts.

So if a user can choose, when alone, to have the password displayed during typing, they have a much better shot at entering lengthy passwords correctly on the first try.

### 2. Allow Password “Paste-In”

If passwords are easier to enter, your users are more likely to use a longer, more complex password in the first place (which is more secure). That’s where “paste-in” password functionality is now advantageous &mdash; if entering passwords is as simple as copying and pasting them into a password field; it encourages safer behavior.

This is especially important considering how many passwords the average person has to remember these days and the tools people are using to manage them all.

For example, a [survey by NordPass](https://nordpass.com/blog/password-habits-statistics/) found that 70% of people in the United States and the United Kingdom have more than ten passwords (20% have over 50). And many people have started using password managers to generate and store their passwords. So by allowing paste-in functionality this also allows people to use the auto-fill function of password managers to streamline the authentication process and stay safe at the same time.

### 3. Use Breached Password Protection

The new NIST password guidelines require that every new password be checked against a “blacklist” that includes dictionary words, repetitive or sequential strings, passwords taken in prior security breaches, variations on the site name, commonly used passphrases, or other words and patterns that cybercriminals are likely to guess.

Some [platforms, like Auth0](https://auth0.com/breached-passwords/), take this to another level and check real-time login attempts against a blacklist, ensuring that users are protected even if their passwords are leaked publicly:

<include src="Vidyard" id="fCqj5aaDQT6DgL55yYqczd" />

### 4. Don’t Use “Password Hints”

Some companies try to help users remember complex passwords by offering a hint or requiring them to answer a personal question.

However, with the constant dissemination of personal information on social media or through social engineering, the answers to these prompts are easy to find, making it easy for attackers to breach your user’s accounts. So this practice is now forbidden by the NIST guidelines.

### 5. Limit Password Attempts

Many attackers will attempt to breach an account by logging in over and over again until they figure out the right password (brute-force attack). And a great way to stop these kinds of attacks is to limit the number of login attempts that are allowed before locking the account.

The average attacker will need a lot more attempts than the average typo-prone user. So by including a cutoff or delay, you’ll drastically increase the amount of time an attacker will need to break in (to the point where it’s almost pointless to try).

### 6. Use Multi-Factor Authentication

[Multi-factor authentication](https://auth0.com/multifactor-authentication/) (MFA), also known as two-factor authentication (2FA), requires that users demonstrate at least two of the following in order to log in:

1. “something you know” (like a password)
2. “something you have” (like a phone)
3. “something you are” (like a fingerprint)

**The NIST guidelines now require the use of multi-factor authentication for securing any personal information available online**. However, their guidelines are very specific on what qualifies as a valid form of authentication and what does not.

For example, in the new guidelines, email joins voice-over-internet protocol (VoIP) on NIST’s list of channels that are not acceptable for MFA because they’re not considered out-of-band (OOB) authenticators (they’re not truly a “separate channel” because they do not necessarily prove possession of a second device).

So even if you’re using two-factor authentication, you’ll want to review the NIST guidelines to ensure that the channels you’re using meet NIST standards.

### The SMS Controversy

A previous version of the NIST password guidelines stated that using SMS as a second channel for authentication may not meet OOB requirements and could be disallowed in the future.

This led to a deluge of articles released by the security world declaring the death of SMS-based 2FA. However, the next revision of the NIST guidelines contained no explicit mention of SMS deprecation, leading to confusion.

![Nist guidelines](https://images.ctfassets.net/23aumh6u8s0i/2STV4YKmHKKMmB4xtRBt5u/c478850d37b6aa648fa5bdf87faed42e/sms-controversy)

After [lobbying from the CTIA](https://blogs.sap.com/2017/07/06/rollback-the-united-states-nist-no-longer-recommends-deprecating-sms-for-2fa/), NIST backtracked on its concerns, explicitly including SMS as a valid channel for OOB authentication.

Nevertheless, some concerns about SMS authentication remain valid. [SMS channels can be attacked](https://auth0.com/blog/what-the-new-nist-guidelines-mean-for-authentication/) by smartphone malware and SS7 hacks. In addition, message forwarding and number changes mean that access to messages does not always prove possession of a device.

NIST has not ignored this uncertainty. Their guidelines do insist that authenticators make sure the user’s telephone number is associated with a specific physical device when SMS (or voice) 2FA is used. They further recommend that authenticators watch for behavior such as device swapping, SIM changes, and number porting, which could indicate a compromised channel.

However, the removal of recommendations against SMS indicates that this [widely used 2FA channel is far from dead](https://blogs.sap.com/2017/07/06/rollback-the-united-states-nist-no-longer-recommends-deprecating-sms-for-2fa/). It remains much more secure than email and is an effective way to reduce your reliance on passwords.

## Password Storage Guidelines

Many security attacks have nothing to do with weak passwords and everything to do with the authenticator’s storage of passwords. Here’s what NIST recommends for ensuring passwords are stored securely.

### 1. Secure Your Databases

Your users’ passwords will be stored in a database (or several). So, to protect them, it’s important that access to these databases is limited to essential personnel only.

However, most companies’ databases aren’t as secure as you’d expect.

“The big thing that bothers me is when I go to a customer’s site. Usually, their [database] configuration is so weak that it’s easy to exploit. You usually don’t need buffer overflow or SQL injection [attacks] because the initial setup of the database is totally insecure,” Slavik Markovich, CTO of Sentrigo, told [Dark Reading](https://www.darkreading.com/risk/hackers-choice-top-six-database-attacks/d/d-id/1129481).

So to ensure that your users’ passwords are stored safely, you’ll want to ensure that your databases are secured from the [most common attacks](https://www.darkreading.com/risk/hackers-choice-top-six-database-attacks/d/d-id/1129481) at all times.

Additionally, keep in mind that any authentication credentials your administrators use should follow the NIST guidelines as well since that’s how attackers often gain access.

### 2. Hash Users’ Passwords

Password database breaches are going to happen. However, you can still protect your users in the event they do by hashing their passwords before you store them. For example, [Patreon’s](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/) databases were breached in 2015. But thanks to a strong hashing scheme (bcrypt), the attackers were unable to use the credentials they acquired because they couldn’t revert the password hashes to the original passwords.

The NIST guidelines require that passwords be salted with at least 32 bits of data and hashed with a one-way key derivation function such as Password-Based Key Derivation Function 2 (PBKDF2) or Balloon. The function should be iterated as much as possible (at least 10,000 times) without harming server performance.

In addition, they recommend an additional hash with a salt stored separately from the hashed password. That way, even if the hashed passwords are stolen, brute-force attacks would prove impractical.

## Focus on User Experience to Improve Password Security

Cybersecurity and user experience are often at odds with each other. But the NIST password guidelines are pretty clear: strong password security is rooted in a streamlined user experience.

Your users will always do what makes their lives easiest (and [research shows](https://www.darkreading.com/informationweek-home/password-reuse-abounds-new-survey-shows/d/d-id/1331689) they’ll do so even if they know that behavior compromises their password security). So if you create the kind of user experience that uses this tendency to encourage safe behavior, it helps you both keep their data secure.

_Want to learn more about finding the magical balance between UX and security? [Check out this blog post that lays out our philosophy](https://auth0.com/blog/balancing-ux-and-security-at-auth0/)._


NIST Password Guidelines and Best Practices for 2020

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

MFA adoption urged to fight e-commerce fraud


Fraudulent purchases and data breaches are an incredibly costly problem for online retailers, and they are on the rise. A [ThreatMetrix report](https://www.signifyd.com/blog/2018/06/26/ecommerce-fraud-grow-threatmetrix/) found that in the first quarter of 2018, the growth of e-commerce fraud attempts outpaced the growth of overall e-commerce transactions by 83%.

According to the latest data from [IBM](https://digitalguardian.com/blog/whats-cost-data-breach-2019), the average cost of a data breach is currently $150 per compromised record, and the costs of data breaches will only increase with the passage of new privacy legislation.

For business leaders concerned about protecting profits and customer data from attacks the National Institute of Standards and Technology’s (NIST) [recent guidance for e-commerce businesses](https://www.nccoe.nist.gov/projects/use-cases/multifactor-authentication-ecommerce) to implement multi-factor authentication (MFA) can offer some relief.

<include src="TweetQuote" quoteText="According to the latest data from IBM, the average cost of a data breach is currently $150 per compromised record"/>

When deployed properly, MFA is one of the strongest defenses against fraudulent purchases and administrative data breaches, yet e-commerce has been [slow to adopt it](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf). [Experian’s research](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of businesses currently employ MFA, which they attribute to concerns about it negatively impacting customer experience.

Yet modern MFA solutions allow businesses to balance [security and convenience](https://auth0.com/blog/security-vs-convenience/). The NIST’s guidelines offer actionable advice for e-commerce to catch up to current security standards and what to look for when embracing MFA.

In this piece, we’ll go over what MFA is, how the NIST defines sound MFA solutions, and how e-commerce businesses can effectively implement MFA while balancing their other business needs.

## MFA in a Nutshell

In the simplest terms, [MFA](https://auth0.com/learn/get-started-with-mfa/) is a protocol for determining if individuals using your system are who they claim to be. MFA demands more than one (usually two) types of credentials:

* Something someone knows (like a password or their mother’s maiden name)
* Something they have (such as a phone on which they can receive a one-time SMS code)
* Something they are (biometric ID such as a fingerprint or facial scan)

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

A business using MFA can request additional verification at any point in a user’s session: login, purchase, or when navigating within a site or app.

Developers generally consider MFA to be the safest form of authentication, but there are a wide variety of MFA solutions available, and [they are not all created equally](https://auth0.com/blog/is-multifactor-authentication-the-best-way-to-secure-your-accounts-myths-and-reality/).

Finally, while most of us are familiar with MFA from our own online shopping experiences, it isn’t just for end users. The NIST emphasizes that requiring MFA for e-commerce admins is crucial for preventing data breaches rising from admin phishing attacks.

## Why E-Commerce Needs MFA

The continually-evolving digital threat landscape makes e-commerce businesses particularly vulnerable. As the NIST’s guide explains, 2015 saw the introduction of security improvements to credit cards and in-store terminals. These improvements reduced traditional credit card fraud but had the unintended effect of pushing more theft online.

E-commerce businesses are vulnerable to several types of attack, including [brute force attacks](https://www.scmagazineuk.com/brute-force-dictionary-attacks-400-percent-2017/article/1473168), [phishing](https://www.vadesecure.com/en/ecommerce-security-issues/), and [credential stuffing](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/), which the NIST gives particular focus to in its guidelines.

In credential stuffing, user IDs and passwords stolen from one site are used to log in to another, preying on the tendency of users to recycle the same few passwords. Credential stuffing is arguably the [most dangerous and prevalent](https://blog.barracuda.com/2019/04/02/is-2019-the-year-credential-stuffing-dominates-the-threat-landscape/) security threat of 2019. An [Akamai report](https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/state-of-the-internet-security-retail-attacks-and-api-traffic-report-2019.pdf) found that retail was the single most vulnerable vertical for this attack, with over 10 billion credential abuse attempts in 2018.

<include src="TweetQuote" quoteText="Developers generally consider MFA to be the safest form of authentication"/>

Credential stuffing is difficult to combat, and will likely worsen as hackers develop more sophisticated bots that can combine data from multiple breaches in their attacks. Successful credential stuffing can lead to account takeover. For customers, account takeovers can result in fraudulent purchases being shipped to strangers.

For admins, they can lead to even [more serious data breaches](https://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-and-lessons-learned/).

So how do you know if your current authentication system is at risk for these types of breaches? NIST lists the following common traits of vulnerable systems:

* Allow multiple incorrect logins without account lockouts
* Purchasers have reused the same password on multiple systems
* Accept weak passwords

If any of those describe your company’s authentication system, implementing MFA can quickly patch those leaks to project you and your customers while you strengthen your identity solution.

## What Makes a Good E-Commerce MFA Solution

MFA is open-source technology, but there’s a great deal of variance between implementation methods. NIST specifies a few “must-haves” for MFA solutions to protect your business effectively.

* **Customization**: Not every transaction should require additional authentication, so a good MFA solution allows you to tailor your system to your needs. NIST lists the most common parameters to trigger verification as cost threshold (a purchase above a certain dollar amount) and risk threshold. You can customize your definition of risk any number of ways, such as a customer using a new shipping address, paying with a new card, buying an item commonly associated with fraud, or making a purchase at an unusual time of day.
* **Require MFA for admin tasks**: A criminal with fraudulent admin credentials can do incalculable damage to your business, so NIST recommends that any administration activity requires verification.
* **Dashboards for suspicious activity**: The NIST report specifically mentions that e-commerce businesses should “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.” Auth0’s dashboard does just this: giving you a high-level look at your users, allowing your admins to spot patterns and being aware of new threats as they evolve.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

Auth0 also offers [breached password protection](https://auth0.com/docs/anomaly-detection), which tracks security breaches at third-party sites and flags potentially stolen credentials. Taken together, these features are a proactive way for e-commerce teams to detect and prevent fraudulent transactions.

## How an IDaaS Partner Manages Your MFA Needs

Many e-commerce executives have been slow to push for MFA because they feared alienating customers with irritating demands for credentials. However, online shoppers are increasingly reassured rather than irritated by such measures.

In [Experian’s 2018 Global Fraud and Identity Report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf), 66% of surveyed customers reported that they “like all the security protocols when I interact online because it makes me feel protected." Yet customer tolerance isn’t infinite, and in the same survey, a third of customers reported that security demands caused them to make fewer online purchases.

E-commerce businesses have to find an MFA solution that provides both effective fraud prevention and positive user experiences. By partnering with an identity management platform like Auth0, you can reap the benefits of increased security without taxing your developers or frustrating your customers.

* **Balance of ease and customizability**: Auth0’s MFA solutions can be turned on by flipping a single toggle, so you don’t have to wait weeks or months for your developers to secure your system. However, Auth0 also gives your team the freedom to write customized rules for MFA around any of the parameters discussed above.
* **Reduced friction for users**: Auth0’s MFA lets developers choose which factors for authentication suit their needs, whether that’s SMS, a token generator app, or Guardian, which lets users authenticate via a push notification.This allows users to utilize the MFA method they want while maintaining proper security practices.

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

Guardian doesn’t require your customers to install an app or even have a smartphone, so it’s a truly universal solution that meets both security and UX needs.

* **Evolves with and for you**: Keeping on top of current security standards can be a full-time job. But it’s not your full-time job, so outsourcing MFA to a highly respected and [accredited IDaaS partner](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) like Auth0 can provide peace of mind to your customers and yourself.

## NIST Guidance Can Offer Immediate Protection

Though NIST’s guidelines are voluntary suggestions, their very existence points to the urgent need for MFA adoption to protect online shopping as a whole. As the guide says: “fraud impacts the e-commerce ecosystem by decreasing purchaser confidence...and by increasing costs to offset the e-commerce fraud.”

Business leaders are under pressure to protect their customers from identity-based attacks without sacrificing revenue through excessive security measures. Finding this balance requires expert help, so reach out to an [Auth0 resource](mailto: sales@auth0.com) to talk about how you can put NIST advice into practice.

<include src="asides/AboutAuth0" />

---


Why NIST Recommends MFA to Fight E-Commerce Fraud

Business leaders can use NIST guidelines to craft privacy policies that drive results.


The National Institute of Standards and Technology (NIST) sets the rules that govern the protection of digital identities for federal agencies in the United States — yet NIST policies can also be secret weapons for other organizations striving to stay on the front lines of digital security.

If you’re tasked with organizing and processing sensitive data for your team, you can’t afford to ignore the new [2019 NIST Privacy Framework draft](https://www.nist.gov/privacy-framework/working-drafts).

More than a policy to simply adhere to, the Privacy Framework, which builds on the widely adopted [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework), includes important takeaways that can help your organization meet its cybersecurity needs more efficiently and effectively (and free your technical talent up for projects that clearly drive ROI).

NIST emphasizes how important it is not to treat user privacy as an externality — a risk that’s isolated from your core operation, to be treated independently (e.g., after a [data breach](https://auth0.com/blog/what-is-a-data-breach/)). Instead, NIST helps you build privacy into the design of your organization. This can significantly reduce the risk of data loss and data breaches — and can help teams scale with a more sustainable foundation.

Before you wade through the full text of the NIST Privacy Framework draft, this piece digs into its fundamentals, highlights important differences from the Cybersecurity Framework, and offers suggestions for using the Privacy Framework to shape a more stable and successful business.

## How To Approach the NIST Privacy Framework

To realize the value of the NIST Privacy Framework, it’s important to understand its current structure.

The NIST Privacy Framework has three major parts: the Core, the Profile, and the Implementation Tiers. 

* **Core:** A set of activities and outcomes that you use to communicate privacy priorities across your organization. You can use your Core to quickly communicate and plan your privacy risk strategy. 
* **Profile:** The privacy outcomes you want to achieve, which you can select from the Privacy Framework and tailor to your needs. You can design a current Profile that identifies your current state, and build toward a target Profile that identifies your goals. 
* **Implementation Tiers:** The kinds of approaches you can take to meet your goals. NIST provides a spectrum, from reactive responses to agile strategies. 

If you’re not a U.S. federal agency, NIST doesn’t require strict compliance. Instead, it serves as a comprehensive resource to support organizations in making more informed and valuable decisions about privacy. 

As with its [Cybersecurity Framework](https://www.nist.gov/cyberframework), NIST writes flexibility into its privacy guidelines, encouraging readers to customize its principles to their specific business and industry. It’s up to each team to tailor NIST approaches to achieve their desired outcomes.

Below are five key takeaways from the 2019 NIST Privacy Framework draft that can support teams as they scale.

## 1. Distinguish between cybersecurity and privacy to create a more powerful platform

Although the Privacy Framework shares several goals and tools with the Cybersecurity Framework, NIST created it as a standalone document for good reason. In 2018, Ponemon found that internal issues of data privacy (including system glitches, human error or negligence) cost companies a [combined $259 per record to resolve](https://www.ibm.com/security/data-breach?ce=ISM0484&ct=SWG&cmp=IBMSocial&cm=h&cr=Security&ccy=US&cm_mc_uid=85865526986315615699666&cm_mc_sid_50200000=99514441561569966657&cm_mc_sid_52640000=93472991561569966677) — in contrast with the cost of an outside cybersecurity incident at $157 per record.

Cybersecurity procedures go a long way toward protecting data from unauthorized activity, but privacy risks [are increasingly embedded in a system’s architecture](https://www.bankinfosecurity.com/nist-creating-privacy-risk-management-framework-a-8271). They arise from the regular, authorized data processing and analyses that teams undertake on an ongoing basis to achieve their mission and set and hit their KPIs.

![Venn diagram of Cybersecurity and Privacy Relationship](https://images.ctfassets.net/23aumh6u8s0i/3Thsp6v4gS1TNvjAg6uZai/9f110ab9bf96ed4b459203a7e3edfc1f/privacy-risk-diagram)
[Source: [NIST](https://www.nist.gov/sites/default/files/documents/2019/04/30/nist-privacy-framework-discussion-draft.pdf)]

For teams looking for the most powerful and precise ways to protect their data, distinguishing between the two — and giving weight to each — is essential. 

To this end, NIST suggests creating separate privacy policies that specifically address data processing. This can go a long way towards reducing errors on the part of authorized employees, negative consequences for customers, and adverse impacts on company health.

## 2. Build systems that enable you to control data (and harness it to your advantage)

Controlling sensitive data, such as user credentials or customers’ financial information, is imperative for any team today. Yet, as your team’s information grows in volume and becomes more complex, it can be a challenge to set clear policies on how to do this. Moreover, data control can create tension within a team. Since data is often spread throughout a company, data control often requires input from several departments, each of whom may be used to setting up and executing on their policies independently. 

To help streamline the process, NIST pushes for greater transparency about privacy practices — which many companies lack. According to NIST, it’s common to bolster privacy by way of *obscurity*. This includes scheduling data for automatic deletion or using cryptographic techniques that make it hard for the organization itself to access data. Obscurity might grant a degree of privacy, but it also limits your ability to keep your users informed and respond proactively.

A solution like [Auth0’s Dashboard](https://auth0.com/docs/dashboard) can help you open up this process. Team members can view (in real-time and historically) who is accessing and working with data sets. 

![Image showing Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/5vutGoL0hYC6nLL811xPxx/f7cf833796ab0b313f3cec9030a9c9d4/auth0-dashboard)

In addition, it’s simple for Dashboard admins to manage privileges of user accounts and configure it for any given tenant. This clarity and ease-of-use reduces risk of data loss, ensuring only those who *should* have privileges to move or manipulate the information *do*.

While many sections in the Privacy Framework draft are lifted from NIST’s prior Cybersecurity Framework, its emphasis on keeping everyone on a team informed about data control and data privacy processes is new.

According to NIST, it’s critical to make this information available and digestible to its employees. Doing so helps builds accountability within an organization. In the event of a systems breach or data loss, for example, it becomes clear who was responsible for keeping the information secure. In addition, it helps expose vulnerabilities that a team can move swiftly to fix. 

## 3. Think on an industry level to create comprehensive privacy policies

When it comes to data, the amount of intermediaries between businesses and their users can be dizzying. A single organization might use multiple cloud services for storage, several [customer intelligence tools](https://auth0.com/blog/three-tools-to-improve-your-customer-intelligence/) to inform outreach, and numerous data analysis tools to shape user onboarding. 

Even a simple landing page might rely on traffic from Facebook ads, [user feedback from Hotjar](https://www.hotjar.com/blog/what-is-hotjar), email address collection from Mailchimp, and on-demand server elasticity from Amazon Web Services (AWS).

NIST drives home that agencies must consider these external relationships when developing their privacy policies — or risk data exposure on a regular basis. Moreover, NIST wants teams to think beyond what information they might share with their partners and conceptualize risk management in their industry more broadly.

For example, one business might be a service provider to other businesses, offer products to individual customers, and work with regulatory organizations. Privacy-focused teams have to think up and down the stack, considering privacy needs and requirements across a web of stakeholders, as NIST depicts in the figure below.  

![Diagram of ecosystem relationships from NIST](https://images.ctfassets.net/23aumh6u8s0i/7eabfqCS4VS2tm47iTLCMe/50880373173382089ec1df61626ef4a8/ecosystem-relationships)
[Source: [NIST](https://www.nist.gov/sites/default/files/documents/2019/04/30/nist-privacy-framework-discussion-draft.pdf)]

Business leaders can use NIST’s recommendations to determine the privacy requirements they want from partners and write contracts that codify and enforce them. To solidify these requirements, NIST recommends communicating about them with third parties regularly, showing partners how you’ll verify and validate them. 

## 4. Design response plans to reduce reputational damage

The scale and precision with which hackers now operate mean every organization needs to plan for a hack or breach — no matter their size or how comprehensive their current security systems. Even [startups](https://auth0.com/blog/data-breach-response-planning-for-startups/) just beginning to capture and store user data have to keep this front of mind.

In addition, a response plan must be deliberate and thorough. According to NIST, response plans should involve internal and external stakeholders, such as law enforcement and lawyers specializing in cybersecurity. NIST strongly suggests including notification systems that enable teams to move quickly to mitigate and contain privacy problems. 

This can be a daunting task for any security team — yet the faster and more accurately you can respond, the more impressive you will appear to your users. In 2018 Ponemon found the teams with clear incident response (IR) protocol were able to reduce the cost of a data breach by [$14 per compromised record](https://www.ibm.com/security/data-breach?ce=ISM0484&ct=SWG&cmp=IBMSocial&cm=h&cr=Security&ccy=US&cm_mc_uid=85865526986315615699666&cm_mc_sid_50200000=99514441561569966657&cm_mc_sid_52640000=93472991561569966677) — resulting in an adjusted cost of $134/record v. $148/record. Multiplied by thousands or even millions of users, this cost savings quickly adds up. 

On the flip side, if you’re slow and opaque, you could quickly lose your customers’ trust — and be subject to additional fines. For example, the [California Consumer Privacy Act (CCPA)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375) will institute fines of up to $7,500 for each privacy violation. In addition, the CCPA allows individuals to sue for any breach of their “non-encrypted or non-redacted personal information” — whether or not they incurred damages.

Privacy issues can be extremely complex, but your response doesn’t have to be. For example, implementing a tool like [Auth0’s breached password notification](https://auth0.com/breached-passwords) can afford you the insight you need to immediately detect threats — and ability to take action. If a user’s password is leaked or stolen as a result of a data breach, Auth0 will notify you immediately. Once you’re informed, you can also inform your users. This underscores your skills and reinforces how much you care about those you work with. 

## 5. Prioritize identity management to scale without fear

The NIST Privacy Framework places a special emphasis on identity management. If your business involves processing data, then the ability to authenticate and authorize access to the right individuals is fundamental.

According to NIST, organizations should be able to issue, manage, verify, revoke, and audit credentials as necessary. “Protect,” one of five functions in the NIST Privacy Framework’s Core, emphasizes the infrastructure that enables identity management, authentication, and [data security](https://auth0.com/blog/what-is-data-security/). 

Implementing granular [user management](https://auth0.com/user-management), especially at scale, can be very complex. Even at the behest of NIST, it’s difficult for many organizations to allocate adequate resources to build an identity management system that serves their current needs — and is flexible enough to grow with them. 

As you bring on partners, develop mobile apps or APIs, grow your user bases, or enter regulated industries, you might find you have to keep rebuilding your system. For this reason, businesses that want to get up to speed on identity, and remain at speed, often choose to [buy rather than build](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management) their identity infrastructure. Partnering with identity experts like Auth0, focused exclusively on these solutions 24/7, can give you peace of mind and more leeway to create and refine your core products. 

### Make Privacy a Core Concern

NIST Frameworks are best together. Both the Cybersecurity Framework and the Privacy Framework can inform your approach to security, privacy, and risk management. 

In particular, the NIST Privacy Framework enables businesses of all sizes to make privacy a priority. Rising public concern about privacy means that if businesses truly want to put customers first, they need to figure out how to put privacy front and center. NIST lays out a variety of tools you can use to build a path toward being a privacy leader. 

The current draft is [available online](https://www.nist.gov/sites/default/files/documents/2019/04/30/nist-privacy-framework-discussion-draft.pdf), and if you have feedback, you can [contact NIST](https://www.nist.gov/privacy-framework/working-drafts). As it did with the Cybersecurity Framework, NIST is currently gathering feedback from privacy and security specialists and expects to release a final version by October 2019.

<include src="asides/AboutAuth0" />


5 Valuable Takeaways From The 2019 NIST Privacy Framework Draft

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Learn about NIST's Digital Authentication Guideline and what it means for authentication security.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>The new 2019 NIST Privacy Framework Draft can help your organization meet its cybersecurity needs more efficiently and effectively. <a href="https://auth0.com/blog/5-takeaways-from-2019-nist-privacy-draft/?utm_source=auth0blog&utm_medium=messagebox&utm_campaign=nist_2019/">Read 5 valuable takeaways from the Privacy Framework.</a></strong>
</div>

**TL;DR:** The US National Institute of Standards and Technology ([NIST](https://www.nist.gov/)) is creating new policies for Federal agencies implementing authentication. Learn about [NIST Special Publication 800-63-3: Digital Authentication Guideline](https://pages.nist.gov/800-63-3/sp800-63-3.html) and what it means for authentication security. 

---

## NIST Digital Authentication Guideline

The [US National Institute of Standards and Technology (NIST)](https://www.nist.gov/) has created new policies for Federal agencies implementing authentication.

![Digital Authentication Guideline: US NIST logo](https://images.ctfassets.net/23aumh6u8s0i/64gd0WJ9nBSh86HbwGfqzG/7327fa02c5c28b33128f8ce9895279d7/nist)

The Digital Identity Guidelines — [**Special Publication 800-63-3** — are available on the NIST website](https://pages.nist.gov/800-63-3/sp800-63-3.html) as well as [on NIST's GitHub](https://github.com/usnistgov/800-63-3). The suite of documents includes the following:

* [800-63-3: Digital Authentication Guideline](https://pages.nist.gov/800-63-3/sp800-63-3.html) (overview)
* [800-63A: Enrollment & Identity Proofing](https://pages.nist.gov/800-63-3/sp800-63a.html)
* [800-63B: Authentication & Lifecycle Management](https://pages.nist.gov/800-63-3/sp800-63b.html)
* [800-63C: Federation & Assertions](https://pages.nist.gov/800-63-3/sp800-63c.html)

The policies are intended for Federal agency applications, but serve as a standard for many others as well.

## NIST Improved Password Requirements

The NIST Digital Authentication Guidelines strives for improved password requirements. One of the guiding principles is _better user experience_ and shifting the burden to the verifier whenever possible. In order to support the creation of passwords that users will remember while implementing excellent security, several guidelines are important:

* Length: 8 character minimum, >64 character maximum
* Compare new passwords to a [dictionary](https://auth0.com/docs/connections/database/password-options#password-dictionary) and don't allow common, easily-guessed passwords (such as `password`, `abc123`, etc.)
* Allow all printing characters + spaces
* Should offer option to show password rather than dots or asterisks; helps typing accuracy
* Don't enforce composition rules (ie., no "passwords must include uppercase and lowercase letters, a number...", etc.); such rules provide a poor user experience
* Don't use password hints; they weaken authentication 
* Don't expire passwords arbitrarily; regular expiration encourages users to choose easy-to-guess, less secure passwords
* Don't use [Knowledge-based Authentication (KBA)](https://en.wikipedia.org/wiki/Knowledge-based_authentication)

## NIST Guidelines for Password Storage

NIST also supplies guidelines for the verifier's encryption and storage of passwords. These policies ensure that [passwords are stored securely](https://nakedsecurity.sophos.com/2013/11/20/serious-security-how-to-store-your-users-passwords-safely/):

* Passwords shall be hashed with 32-bit (or greater) random salt
* Use approved key derivation function [PBKDF2](https://www.ietf.org/rfc/rfc6070.txt) using [SHA-1, SHA-2, or SHA-3](https://en.wikipedia.org/wiki/Secure_Hash_Algorithm) with at least 10,000 iterations
* Passwords should use keyed [HMAC](https://tools.ietf.org/html/rfc2104) hash with the key stored separately

## NIST on Multifactor Authentication

NIST recommends utilizing [out-of-band (OOB) authentication](https://www.techopedia.com/definition/29532/out-of-band-authentication-ooba) to provide [2-factor Authentication (2FA)](https://auth0.com/learn/two-factor-authentication/). The guidelines also state that **SMS is _deprecated_ for OOB authentication**. SMS can be compromised by a variety of threats such as smartphone malware, [SS7 attacks](https://www.theguardian.com/technology/2016/apr/19/ss7-hack-explained-mobile-phone-vulnerability-snooping-texts-calls), forwarding, change of phone number, and more.

Examples of non-SMS OOB authenticators include [Auth0 Guardian](https://auth0.com/docs/multifactor-authentication/guardian), [Duo Mobile](https://duo.com/solutions/features/two-factor-authentication-methods/duo-mobile), and [Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=en). NIST states that use of biometrics must be _with_ another authentication factor for [Multifactor Authentication](https://auth0.com/docs/multifactor-authentication).

## Conclusion

Overall, the new guidelines put the user experience at the forefront while also establishing more robust storage and authentication methods. Although the NIST Digital Authentication Guideline governs Federal sites, its tenets are good standards for _any_ app or site with authentication. Federal agencies as well as many other companies and vendors must make strides to comply with the new guidelines for improved authentication security and user experience. **Auth0 supports the NIST guidelines** with more configurable password policies. To learn more, check out the [NIST Special Publication 800-63-3](https://pages.nist.gov/800-63-3/sp800-63-3.html) itself and [Jim Fenton's "Toward Better Password Requirements"](http://www.slideshare.net/jim_fenton/toward-better-password-requirements) presentation.


"NIST"