The Importance of Strong Passwords in Keeping Your Data Safe

Over the last few years, the National Institute of Standards and Technology (NIST) have made updated recommendations for adequate password protections. Among those suggestions are the obvious, like no sequential numbers, and the not so obvious—such as the ability to use any special character if desired. The most important recommendation was to “restrict passwords obtained from previous breach corpuses.”

At Orion, improvements have been made to bring password security up to the stringent but important recommendations handed down by the NIST.

With the latest product release, a host of updates to password security were unveiled, the most profound surrounding passwords that have been used in previous breaches across the internet. Now, if you are using a password that has at any point in time been compromised, you will be prompted to reset your password upon login to Orion Connect. You will not be able to log in until your password is changed in accordance with the new password strength requirements, which are detailed below.

A new user experience includes a password criteria checklist, making it easier to see if you’ve met the strength requirements. These changes apply to clients when logging into their client portal as well.

Also new this month, there is now a gauge telling you if your password is weak or strong, as well as a checklist that indicates when the criteria for the password are satisfied. This allows for more informed decisions when creating a new password. Additionally, when entering your password, you have the option to click on an eye icon in the field to show or hide the characters.

You also have the option to select “Remember my device” for devices that you trust, and the device will be remembered for the next login.

These changes, made during the March software release, are in addition to other updates from the last few months. Among them are:

• ​The minimum password length is now 10 characters
• ​You cannot change your password to one that is known to be compromised
• ​Your password cannot contain your first or last names, your user ID, your email address, or variations of the words “password,” “Orion” or “Advisor/Adviser”
• ​Passwords will not be able to contain several date-related words (year, month name, and season)
• ​Passwords will no longer expire
• ​Security questions will be removed
• ​Several new multi-factor authentication options will be added, in addition to email and text message

Tips and Tricks for Creating and Maintaining a Secure Password

Do not reuse passwords across websites

Even if you have created a strong password that you can easily remember, once that password is compromised, your data on every site where you have used that password is now vulnerable.

Adhere to modern password guidelines

To do this, we have to disregard some habits of the past. Today, complex passwords, with variations of upper and lower case, numbers and special characters, are not necessarily stronger. Longer is always better in today’s world. Password hints can easily be found in the age of social media, so do not use them as a means of password recovery.

Use a password manager, but not the one built into your web browser

Using a password manager means you only have to remember one complex password and the rest are stored away for safekeeping. Internally at Orion, RoboForm is used, but 1Password and LastPass have high marks from industry experts as well.

Set up multi-factor authentication

It seems simple, but it is very effective. Even if your password is compromised, this is another layer of protection that saves your information from being stolen.

If you have any questions or concerns on how password protection is being improved, please reach out to securityteam@orion.com.