Email security: passwords, sign-in and phishing
CISA, in guidance released February 1, 2021, describes phishing as email or a malicious website that asks for personal information while posing as a trustworthy organization. Indicators it names: a sender address that imitates a real business by changing a few characters, a generic greeting, a link whose destination does not match the visible text, and an unsolicited attachment.
CISA says not to follow links in that kind of email, and to verify a request with a known contact instead of the details inside the message.
How long should a mailbox password be?
NIST SP 800-63B, in the SP 800-63-4 text, says a password used as the only factor shall be at least 15 characters. A password used only as one part of multi-factor authentication shall be at least 8 characters.
The same section says verifiers shall not impose extra composition rules, such as requiring a mix of character types, and shall not require periodic password changes without evidence of compromise. Use a different password for each mailbox. Do not copy an example string from an article.
Does a second sign-in factor stop phishing?
It does not make a fake page harmless. CISA says to enforce multifactor authentication, and in the same guidance says not to follow links in a solicitation and to check the site address. A person can still type a code into a page they reached from the message. Read the address before you sign in. Turn the second factor on in the provider's current security screen. Those menus move.
Securing a mailbox does not by itself make a business HIPAA or GDPR compliant. There is no price on this page. Practical handling of junk folders is on managing spam filters.
Related reading
Key takeaways
- CISA describes phishing as email or a malicious website that asks for personal information while posing as a trustworthy organization.
- Do not follow links in that kind of email; verify a request with a known contact instead.
- NIST says a password used as the only factor shall be at least 15 characters, or at least 8 characters when it is one part of multi-factor authentication.
- A second sign-in factor does not make a fake page harmless.
Next step: Book a consultation.