NIST’s New Password Rule Book: Updated Guidelines Offer Benefits and Risk

The updated US National Institute of Standards and Technology (NIST) standards on password security published in the NIST Special Publication (SP) 800-63-3 “Digital Identity Guidelines”¹ represent a novel approach to improve IT security while working with, rather than against, the capabilities and limitations of the weakest link in information security: the users themselves. The updated NIST guidelines offer adopters a number of advantages in usability and security while introducing new risk and implementation challenges. These issues should be carefully considered before, during and after implementation of the new guidelines.