Frequency of compromised passwords used by students and staff of Asia Pacific College: an analysis using NIST SP 800-63B and pwned passwords

International Conference on Information Technology and Digital Applications 2018

计算机科学;无线电电子学

Roig, J.V.^1 ; De La Cuesta, J.^2 ; Castillo, J.^3 ; Cabardo, J.^2 ; Casiño, E.^2 ; Salalima, E.^3 ; Sanchez, M.^2

Advanced Research and Consulting, Asia Pacific College, Philippines^1

School of Computing and Information Technology, Asia Pacific College, Philippines^2

Information Technology Resources Office, Asia Pacific College, Philippines^3

关键词: IT security;    National Institute of Standards and Technology;   

Others  :  https://iopscience.iop.org/article/10.1088/1757-899X/482/1/012035/pdf
DOI  :  10.1088/1757-899X/482/1/012035

学科分类：计算机科学（综合）

来源: IOP

【 摘 要 】

The National Institute of Standards and Technology (NIST) released new guidelines in June of 2017 that recommended new standards for managing and accepting user passwords. Among the new guidelines is a requirement that verifiers should check if a user's supplied password is compromised-that is, already listed in previous breach corpuses. Using a corpus of 320 million breached passwords, the researchers conducted an experiment to gauge what percentage of the population of their home institution, Asia Pacific College, use compromised passwords. The study found that 16.72% overall-or 1 in 6 people-were using passwords that are part of the 320M breach corpus. This paper also provides a methodology that other institutions and companies can use to conduct the same analysis in order to gather data specific to their population that can guide the improvement of their password policies and related IT security services.