Advice is like mushrooms, the wrong kind can prove fatal
summary
Collected 269 pieces of advice from 21 sources and sorted into 29 categories, revealing direct contradictions (e.g., reuse vs alter passwords, require special characters vs allow all). A cost–benefit model converts seven cost types (user time, admin time, churn, compute, enforcement, reset burden, repetition) and attack frequencies (sourced from Verizon 2017) into monetary terms. Comparing policies shows NIST 2017 gives higher benefits and much lower costs and NIST 2003 becomes net-negative past roughly 1,000 users.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:10Categories of Password Advice
- 5:28Build a Model for the Costs
- 7:47Benefit of a Password Policy
- 8:06Calculate the Loss as a Result of a Successful Attack
- 9:12Calculate the Probability of a Successful Attack
- 10:24Benefits Equation
- 15:52Conclusion
related talks
39mKeynote - The Infosec Survival Field Guide
47mYour Cybersecurity Budget Is a Horse’s Behind
22mSecurity and Risks
23mBuilding a cost-benefit analysis for passwordless solutions
50mThe Price is WRONG - An Analysis of Security Complexity
30mCybersecurity Silver Linings
32mROI 101: Business Justification
45mHow to win friends and influence your security team