In early September 2019, the DLA Internet Bid Board System (DIBBS) implemented new password requirements in line with the updated Department of Defence (DoD) security requirements. As a portal for contractors to submit quotes and proposals to the Defence Logistics Agency (DLA), DIBBS is home to potentially sensitive information that must be protected with robust cybersecurity measures. The September 2019 update reflects this by introducing new requirements to strengthen security.
Let’s take a look at the new DIBBS password format as well as the reasoning behind any changes. It’s important to note that any attempts we make to explain the logic behind changes to the password rules didn’t come from DIBBS or any other US government agency. Instead, our reasoning is based on current cybersecurity best practices within the industry.
1- Your password must be a minimum of 15 characters long and a maximum of 60 characters long. When it comes to passwords, longer is better. Increasingly the length of your password dramatically increases the time it will take to crack it.
2- Your password must contain at least 2 characters from each of the following 4 character classes listed below:
3- Your password must not have more than 4 Upper and Lower case letters in a row. Additionally, no more than 4 numbers in a row are allowed.
4- The first three characters of the password must be different from each other. For example, “thb” or “abc” would be allowed, but “jjj”, “aab”, or “bab” would not be allowed.
5- The password must not contain more than one special character in a row. For example, “$$” would not be allowed. Repeating characters makes it easier for you to remember the password, but it also makes it easier for a computer to crack it.
6- The password must not begin or end with “!”. Additionally, ampersand (&) cannot be the first special character used in the password. However, it can be the second or subsequent special character used. “!” is one of the first characters on most keyboards so a lot of users will choose this as their first special character. This is known to hackers and therefore inherently weak. “&” is also very commonly used because it is both a special character and a replacement for one of the most used words in the English language.
7- The new password must be different from your last 10 passwords. Reusing passwords dramatically increases the risk of using a password that has been exposed in a data breach and is now known to hackers. Unless you are continually monitoring your passwords by checking them against known exposed passwords or continually checking data breach news, you may be unaware your password has been exposed.
8- Your new password must differ from your previous password by at least 8 characters. This was previously 4 characters. Changing a character from uppercase to lower case or vice versa satisfies the requirement for a change.
9- Passwords are valid for 60 days and then must be changed. It’s advised that users should frequently change their password to reduce the risk of continually using an exposed password.
10- The use of dictionary words from any language is prohibited. This is because password cracking programs that can run through millions of words in a matter of seconds are in widespread use.
11- Passwords should be complex, but also easy to remember. Complexity in this context tends to mean an element of randomness – something that isn’t easy to decipher at a glance and would appear illogical to anyone reading it. It also means that you make good use of all the character sets available to you. Complex passwords are harder for computers to crack because the computer will have to run through many millions of combinations before arriving at the right one. This isn’t the case when you use simple passwords that are all in one case, use repeating characters, or only use one type of character class.
12- The use of personal information in passwords is prohibited. For example, names, telephone numbers, account names, and birthplaces are not allowed. Hackers understand that people often use personal information in passwords because it makes the password easier to remember. Learning this personal information is often the motivation behind phishing attacks. Put simply, unless it’s something ONLY you know, like the name of a pet spider you had when you were a kid that you never told a single soul about, you shouldn’t incorporate it into your password.
13- DIBBS also recommends that you should change passwords with Internet Explorer or Firefox to avoid possible issues.
The new DIBBS password format is attempting to make authentication more secure and while some of the requirements seem onerous, they can make passwords more secure. Beyond just the above password requirements, we would also recommend that screening passwords for exposure would be a logical next step.
Learn more about compromised password screening.