Password Policies and Multi-Factor Authentication

Passwords remain the most common authentication mechanism despite being the most frequently compromised. Attackers steal passwords through phishing, credential stuffing (reusing breached credentials), brute-force attacks, and keyloggers. Even a 'strong' password provides limited protection if an attacker can silently capture it. Password policies set minimum requirements for complexity and rotation to reduce risk, but the most impactful security improvement is adding a second factor — because knowing the password is no longer sufficient to gain access.

Effective password complexity policies define minimum standards that make passwords harder to crack. Traditional requirements include: minimum length (12-16 characters minimum; length matters more than complexity), required character types (uppercase, lowercase, numbers, symbols), prohibition of common passwords (password dictionaries), and prohibition of the username or organization name within the password. NIST SP 800-63B guidelines updated in 2017 recommend prioritizing length over arbitrary complexity rules and checking passwords against breached credential databases rather than requiring frequent rotation.

NIST SP 800-63B (Digital Identity Guidelines) significantly revised password best practices. Key updates: don't require periodic rotation unless there is evidence of compromise — forced rotation leads users to make predictable changes (Password1! → Password2!); do check against breach databases at creation and allow users to see their password while typing; allow long passphrases up to 64 characters; eliminate arbitrary complexity rules that produce predictable patterns; and implement account lockout or throttling to prevent brute-force attacks rather than relying solely on complexity.

Authentication relies on one or more of three factor types. Something you know (knowledge factor): passwords, PINs, security questions, passphrases. Something you have (possession factor): physical token, smartphone with authenticator app, smart card, hardware key (YubiKey). Something you are (inherence factor): fingerprint, retina scan, face recognition, voice pattern, behavioral biometrics. A fourth category — somewhere you are (location) — is sometimes added. Using a factor from two or more categories is multi-factor authentication (MFA). Two factors from the same category (like two passwords) is not MFA.

Multi-factor authentication (MFA) is one of the most impactful security controls available. Microsoft research indicates MFA blocks 99.9% of account compromise attacks. The reason: phishing or credential theft gives an attacker 'something you know' (password), but they typically cannot also obtain the second factor (a smartphone one-time code or hardware key). Even if a user's password is published in a breach database, the account remains protected if MFA is enabled. Organizations that have implemented MFA rarely appear in breach reports involving credential-based account takeover.

SMS One-Time Passwords (OTP) are the most widely deployed MFA method — a 6-digit code sent by text message. They are better than no MFA, but have documented weaknesses. SIM swapping attacks: attackers impersonate the victim to the mobile carrier and transfer the phone number to their SIM, intercepting future OTP codes. SS7 protocol vulnerabilities: the telephone network's signaling protocol has known flaws that allow SMS interception. Real-time phishing: sophisticated phishing proxies relay OTPs in real time, bypassing them. NIST SP 800-63B has restricted SMS OTP to 'restricted authenticator' status. Authenticator apps or hardware tokens are preferred.

TOTP (Time-Based One-Time Passwords) — standardized in RFC 6238 — generates 6-digit codes from a shared secret and the current time. Apps like Google Authenticator, Authy, and Microsoft Authenticator implement TOTP. The code changes every 30 seconds and is only valid for one authentication attempt. Unlike SMS OTP, TOTP does not traverse the phone network, so it is immune to SIM swapping and SS7 attacks. The shared secret is exchanged once (via QR code during setup) and stored in the authenticator app — requiring physical access to the registered device to generate codes.

FIDO2 (Fast Identity Online 2) and its web implementation WebAuthn represent the most phishing-resistant authentication standard available. FIDO2 uses public key cryptography at the device level — the authenticator (hardware key like YubiKey, or device biometric like Windows Hello) stores a private key that never leaves the device. Authentication is cryptographically bound to the specific origin (website), making it immune to phishing: even if a user is tricked into visiting a fake site, the authentication challenge will fail because the origin doesn't match. FIDO2 is the gold standard for high-security authentication.

Physical hardware tokens provide 'something you have' independent of smartphones. HOTP (HMAC-based OTP) — standardized in RFC 4226 — generates a code from a counter and shared secret; the counter increments each time the button is pressed. Unlike TOTP, HOTP codes don't expire on a timer but must be used in sequence. Smart cards (like PIV cards used by US government employees) store private keys in tamper-resistant hardware and require a PIN to unlock, combining 'something you have' (the card) with 'something you know' (PIN). Smart card authentication is the standard for privileged access in high-security environments.

Password managers solve the human tendency to reuse passwords by generating and storing unique, random passwords for every site. The master password unlocks an encrypted vault containing all credentials. Enterprise password managers (1Password Teams, Bitwarden Business, CyberArk) add features like centralized policy enforcement, audit logs, secure sharing, and emergency access. Security teams should actively encourage or mandate password manager adoption — it's a rare security control that improves both security (unique passwords everywhere) and usability (no need to remember dozens of passwords). Combined with MFA, password managers dramatically reduce credential-based account compromise.

Account lockout disables an account after a defined number of failed login attempts, preventing brute-force attacks. Typical policies lock an account after 3-10 failed attempts, with lockout duration ranging from a fixed period (30 minutes) to requiring admin unlock. Throttling is a softer alternative: instead of locking accounts, it progressively increases the delay between login attempts, making brute-force attacks take years instead of minutes without the user-experience impact of lockouts. Web applications should implement both — rate limiting at the API level and account-level throttling — to prevent automated credential attacks.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: NIST SP 800-63B recommends long passphrases and breach-checking over complex rotation policies; the three MFA factors are know, have, and are; TOTP apps are more secure than SMS OTP; FIDO2/WebAuthn is phishing-resistant; and account lockout prevents brute-force attacks. Next up we explore Biometrics and Token-Based Authentication.