Tag: NIST 800-63B

1. Introduction Your company’s password policy probably still forces employees to change passwords every 90 days and to combine uppercase, lowercase, numbers and symbols. Those two rules, ubiquitous in corporate environments, have been discredited by the standard that security teams cite as their reference: NIST SP 800-63B. In this article we explain what the standard says, why arbitrary expiry and superficial complexity protect nothing, and how to build a modern business password policy aligned with the guidelines NIST published from 2017 onward and updated in 2024. The underlying reason is simple: today’s attacker does not “guess” passwords at the keyboard; …