Amazon.co.uk Widgets

Log in

X
Your password has been changed

Keys are simple to understand. We all have them, you can't open a door without one. Mostly they are made of metal and fit in a lock. People have been using keys for hundreds of years. Passwords and password security not so much. People are just bad at passwords. User access control policies are unwieldy and irritating and yet people get around them. I remember the induction to a well-known telecommunictions companies system where the trainer said:

"You have to change your password every three months, you can't re-use them again and they have to have a capital letter and a number, so just use something simple like the month and year and you'll always remember it, for example "May2024".

I like to think most of those employees passwords still use this easy to remember method, blissfully unaware that it renders the password itself almost completely useless.

So, what to do? You need passwords for now, they are still used in the vast majority of systems. But adding two-factor authentication with a security key as the second factor in addition to your password means there is a 0% possibility of a password attack or stolen or compromised password. That reassuring number has got to be worth a little admin and the small investment in a physical key! 

And write a policy. It doesn't have to be back breakingly hard to understand and just needs to state what you can and cannot allow.

TL:DR – The benefits outweigh the costs by so much that it is hard to understand why businesses don't or won't use security keys in addition to passwords as a user access control. They massively improve user access control, and enable a business to be able to sail through the User access control section of Cyber Essentials certification here in the UK.

Access Control Policy

Why have an access control policy?

An access control policy is to ensure the correct access to the correct information and resources by the correct people. Passwords and security keys are just one part of such a policy. You'd also expect to have written down rules for authentication, role based access, access rights review, administrator accounts and privilege accounts, provisioning (creation, modification and deletion) of user accounts, remote access, and monitoring and reporting. You ought to have one if you are in business. But having a policy is meaningless, and won't help you get certified unless you review access controls for compliance with it and keep logs of this activity periodically too.

Password-based authentication

Passwords remain important even though security keys make them more secure. Password policies seek to ensure good behaviour when using and managing passwords, and that they are held securely. Using a password manager is crucial these days especially where multiple devices are used. Password managers make it easy to have unique passwords for different accounts or services which is a critical piece of the puzzle in keeping systems and user accounts secure. We do not specify the password manager to be used in our policy, since it depends on the operating system, and the device and the account type.

The password section of my access control policy

Access to systems and information is authenticated by passwords.

  • All user accounts must be require the user to authenticate using a password.
  • Initial passwords provided to users must be changed on first use.
  • Vendor supplied and default passwords are changed immediately upon installation. 
  • The same password is not to be used for more than one system.
  • Passwords are not generic, shared or set at a group level.
  • Passwords are to be kept confidential in a secure password manager and not written down.  
  • The password to the secure passord manager is to be kept in a secure location for emergency use.
  • Passwords are not displayed when entered.
  • Passwords are not coded or included in any scripts or code or macros. 
  • Passwords are encrypted when transmitted over networks.
  • Systems lock out users after a number of failed access attempts. 
  • Passwords have a minimum length and format of 9 characters, at least one special character, one number and a mix of alphanumeric characters.
  • System sessions that are idle for 15 minutes require passwords to be entered to regain access. 
  • Where possible, password reuse is prevented by software policies, otherwise end users have the responsibility to avoid password reuse.
  • Passwords are changed every 90 days.

Two-factor authentication (2FA)

(2FA) is a security process that requires two different forms of identification to verify a user's identity. It's designed to add an extra layer of protection beyond just a username and password. The two factors typically include:

  • Something you know: A password or PIN.
  • Something you have: A physical device like a smartphone, security key, or a biometric like a fingerprint or facial recognition.

By combining these two factors, 2FA makes it significantly harder for unauthorised users to gain access to an account, even if they have the password.

The authentication section of my access control policy

Access to systems and information is authorised by a second factor of authentication.

Acceptable second factors include:

  • Fingerprint, Face or PIN via an Apple device running the standard latest version of its operating system.
  • Fingerptint, Face or PIN via an Android device running the standard latest version of its operating system.
  • Google Titan Security Key.
  • Yubico YubiKey Security Key.
  • Text message is not recommended as a 2FA method and should only be used if no better 2FA method is available.

Exceptions to this requirement for 2FA are to be approved  in writing.

Open Source Password managers

We tend to use the inbuilt password functionality in mobile devices, and recommend keepass for Windows only workloads, and keeweb for macOS, linux and web based access. Both these products are open source, completely free and easy to use.

KeePass – for Windows

KeePass Screenshot - Dominik Reichl, GPL, via Wikimedia Commons

KeeWeb – for macOS and web

KeeWeb Screenshot - Dimitri Witkowski (@antelle), MIT, via Wikimedia Commons

Authentication using a security key

A security key is a security token, typically a physical USB hardware device, which provides a more secure form of multi-factor authentication than, say a phone number (which can be hijacked or subject to SIM swap). Becuse it is a physical device you need to be in possession of it to authenticate. They have often been used by individuals considered to be at a high risk of being targets for hacking, but really are usable by anyone, and cheap to buy and reasonably easy to maintain.

You can buy a Titan Security Key direct from Google (£30), and YubiKey from Amazon (£39.69) both support open standards and can be used with many apps and services. 

Titan Security Key

My Titan Security Key

YubiKey

YubiKey Security Key
My YubiKey Security Key

Because you need to have physical access to the key to authenticate, there is 0% possibility of a password based hack succeeding against an account secured with a security key.

Example of security key use with Facebook

Security keys are for all kinds of applications, in all kinds of settings, and especially useful for those where your most personal information might be being shared. You can use the same security key with multiple applications, keep it in a secure place like a keysafe and you have absolute certainty that your account can only be accessed with it.

Facebook Sign in screen
Facebook Sign in screen
Facebook Sign in - Use an external security key
Facebook Sign in - Use an external security key

Press continue then Insert the security key 

Facebook Sign in - Use security key to continue
Facebook Sign in - Use security key to continue
Facebook Sign in - Security key green tick
Facebook Sign in - Security key green tick

The benefits of strong account security far outweigh the small amount of admin and the purchase cost of the security key.

 

Licences, trademarks, source code licences and attributions

Licences, trademarks, source code licences and attributions

928uk® is a trademark of Multizone Limited, registered in the UK. Multizone and this site is not affiliated with or endorsed by The Joomla! Project™. Any products and services provided through this site are not supported or warrantied by The Joomla! Project or Open Source Matters, Inc. Use of the Joomla!® name, symbol, logo and related trademarks is permitted under a limited licence granted by Open Source Matters, Inc. AdMob™, AdSense™, AdWords™, Android™, Chrome OS™, Chromebook™, Chrome™, DART™, Flutter™, Firebase™, Firestore™, Fuchsia™, Gmail™, Google Maps™, Google Pixel™, Google Play™, Pixelbook Go™, and Pixel™ and other trademarks listed at the Google Brand Resource center are trademarks of Google LLC and this site is not endorsed by or affiliated with Google in any way. Apple and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc. The OSI logo trademark is the trademark of Open Source Initiative. UNIX® and the X® logo are registered trademarks of The Open Group. Any other product or company names may be trademarks™ or registered® trademarks of their respective holders. Use of these trademarks in articles here does not apply affiliation or endorsement by any of them.

Where the source code is published here on ezone.co.uk or on our GitHub by Angus Fox, Multizone Limited it is licenced according to the open source practice for the project concerned.

BSD 3-Clause "New" or "Revised" Licence
Original source code for mobile apps are licenced using the same licence as the one used by "The Flutter Authors". This Licence, the BSD 3-Clause "New" or "Revised" Licence (bsd-3-clause) is a permissive licence with a clause that prohibits others from using the name of the project or its contributors to promote derived products without written consent.
GNU General Public Licence v2.0 or later
Original source code for Joomla! published here on ezone.co.uk by Angus Fox, Multizone Limited is licenced using the same licence as the one used by Joomla!. This Licence, the GNU General Public Licence Version 2 or later (gpl-2.0) is the most widely used free software licence and has a strong copyleft requirement. When distributing derived works, the source code of the work must be made available under the same licence.

You can use any code you find here, just respect the licences and dont use the name of this site or our company to promote derived products without written consent. I mean, why would you? You're not us!

Amazon Associate
As an Amazon Associate we earn from qualifying purchases.
Logo
Our Logo Image is by Freepik. We chose it because its an M and also the letter A twice - and that represents us.