Chapter 4 — Passwords, MFA and password resets
Lesson map
Lesson 04 published. Map, example, EX013.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Password practice"]
N2["4.2 Password manager"]
N3["4.3 Multi-factor authentication"]
N4["4.4 Safe resets"]
N5["Shared mailboxes and lockout"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX013"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Password practice"]
N2["4.2 Password manager"]
N3["4.3 Multi-factor authentication"]
N4["4.4 Safe resets"]
N5["Shared mailboxes and lockout"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX013"]
[Learning outcomes]
|
v
[4.1 Password practice]
|
v
[4.2 Password manager]
|
v
[4.3 Multi-factor authentication]
|
v
[4.4 Safe resets]
|
v
[Shared mailboxes and lockout]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX013]
Learning outcomes
You will (1) explain good password practice; (2) set up multi-factor authentication; (3) reset passwords safely.
4.1 Password practice
Long passphrases are easier to remember and harder to guess than short complex passwords. NIST guidance on digital identity recommends checking new passwords against lists of known breached passwords rather than forcing frequent changes. Harlow & Pike sets a minimum of fourteen characters and blocks common and breached passwords. Fourteen characters is long enough to resist guessing but short enough for a passphrase staff can remember. Blocking breached passwords stops staff choosing ones attackers already have. Nadia explains the change at a staff meeting, with examples of good passphrases.
4.2 Password manager
Staff use many systems: email, accounting software, tax portals and client portals. A password manager lets them use a different strong password for each. The firm adopts a business password manager with shared vaults for team accounts. Reusing passwords means one breached site could expose the firm's tax portal or client portal. Shared vaults let teams use accounts such as a client portal without sending passwords by email. Nadia helps staff set up the manager and import passwords from their browsers.
4.3 Multi-factor authentication
Multi-factor authentication asks for something more than a password, such as approval in an app. Even if a password is phished, the attacker cannot sign in without the second factor. The firm turns it on for email and remote access first. Email comes first because it is the main target of phishing, and remote access because it lets someone reach the file server from outside. The firm plans to extend MFA to the accounting software and portals once staff are used to it. Nadia helps each person set up the app and records who has enrolled.
4.4 Safe resets
Password resets are a common route for impersonation. Nadia follows a procedure: confirm identity by calling the staff member back on their known number or in person, then set a temporary password that must be changed at first sign-in. She never resets a password based only on an email request. The callback works because an attacker who sends an email asking for a reset cannot answer the staff member's desk phone. A temporary password that must be changed means even Nadia does not know the final password. Each reset is logged with the date, user and how identity was confirmed.
Shared mailboxes and lockout
The firm's shared mailbox for client enquiries used to be opened by signing in with a shared password. Now each user opens it through their own account with delegated access, which keeps MFA in place and shows who sent each reply. The shared mailbox's own sign-in is disabled. To slow password guessing, repeated wrong passwords lock an account for fifteen minutes. This is long enough to make guessing slow, but short enough that a staff member who mistypes a few times is not stuck until IT is free. Lockout events appear in the sign-in log, so a pattern of lockouts on one account can be noticed and investigated.
Synthetic case. The request is synthetic.
Errors and limits
Resetting passwords from unverified requests is one of the easiest ways for someone to take over an account.
Exercises
- EX013 — Passphrase reasoning. Why is a long passphrase better than a short complex password? Rubric: 3 = harder to guess, easier to remember;; 2 = longer;; 1 = vague;; 0 = none.
- EX014 — MFA protection. What does MFA protect against when a password is phished? Rubric: 3 = attacker lacks second factor;; 2 = protection;; 1 = vague;; 0 = none.
- EX015 — Reset steps. List the steps of a safe password reset. Rubric: 3 = verify by known channel, temporary password, forced change, log;; 2 = three;; 1 = fewer;; 0 = none.
- EX016 — Shared accounts. How should a shared team login be stored? Rubric: 3 = shared vault with access control;; 2 = password manager;; 1 = spreadsheet;; 0 = none.
Synthesis
Strong passphrases, a password manager, MFA and careful resets protect accounts together.
Continue studying — chapter 04 of 18
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →