Saturday, January 28, 2023
  • Gartner® Report: Prioritizing Security Controls for Enterprise Servers and End-User Endpoints
  • Clarification of Obligations for the Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
  • There’s No There There….Or is There? You Won’t Find Out With DLP
  • CBA AND FIDO: One, Other, or Both?
  • USENIX Security ’22 – R. Spencer Hallyburton, Yupei Liu, Yulong Cao, Z. Morley Mao, Miroslav Pajic – ‘Security Analysis of Camera-LiDAR Fusion Against Black-Box Attacks on Autonomous Vehicles’

Security Boulevard Logo

Security Boulevard

The Home of the Security Bloggers Network

Community Chats Webinars Library
  • Home
    • Cybersecurity News
    • Features
    • Industry Spotlight
    • News Releases
  • Security Bloggers Network
    • Latest Posts
    • Contributors
    • Syndicate Your Blog
    • Write for Security Boulevard
  • Webinars
    • Upcoming Webinars
    • On-Demand Webinars
  • Events
    • Upcoming Events
    • On-Demand Events
  • Chat
    • Security Boulevard Chat
    • Marketing InSecurity Podcast
    • Techstrong.tv Podcast
    • Techstrong.tv Video Podcast
    • TechstrongTV - Twitch
  • Library
  • Related Sites
    • Techstrong Group
    • Container Journal
    • DevOps.com
    • Security Boulevard
    • Techstrong Research
    • Techstrong TV
    • Techstrong.tv Podcast
    • Techstrong.tv Video Podcast
    • Techstrong.tv - Twitch
    • Devops Chat
    • DevOps Dozen
    • DevOps TV
  • Media Kit
  • About Us
  • Sponsor

  • Analytics
  • AppSec
  • CISO
  • Cloud
  • DevOps
  • GRC
  • Identity
  • Incident Response
  • IoT / ICS
  • Threats / Breaches
  • More
    • Blockchain / Digital Currencies
    • Careers
    • Cyberlaw
    • Mobile
    • Social Engineering
  • Humor
Security Bloggers Network 

Home » Security Bloggers Network » The New DIBBS Password Format Explained

SBN

The New DIBBS Password Format Explained

by Enzoic on May 18, 2020

In early September 2019, the DLA Internet Bid Board System (DIBBS) implemented new password requirements in line with the updated Department of Defence (DoD) security requirements. As a portal for contractors to submit quotes and proposals to the Defence Logistics Agency (DLA), DIBBS is home to potentially sensitive information that must be protected with robust cybersecurity measures. The September 2019 update reflects this by introducing new requirements to strengthen security.

Let’s take a look at the new DIBBS password format as well as the reasoning behind any changes. It’s important to note that any attempts we make to explain the logic behind changes to the password rules didn’t come from DIBBS or any other US government agency. Instead, our reasoning is based on current cybersecurity best practices within the industry.

TechStrong Con 2023Sponsorships Available

New DIBBS Password Format

1- Your password must be a minimum of 15 characters long and a maximum of 60 characters long. When it comes to passwords, longer is better. Increasingly the length of your password dramatically increases the time it will take to crack it.

2- Your password must contain at least 2 characters from each of the following 4 character classes listed below:

  • English Upper Case Letters: ABCDEFGHIJKLMNOPQRSTUVWXYZ
  • English Lower Case Letters: abcdefghijklmnopqrstuvwxyz
  • Westernized Arabic Numerals: 0123456789
  • Non-alphanumeric (special characters) @ # $ % ^ & + . = !

3- Your password must not have more than 4 Upper and Lower case letters in a row. Additionally, no more than 4 numbers in a row are allowed.

4- The first three characters of the password must be different from each other. For example, “thb” or “abc” would be allowed, but “jjj”, “aab”, or “bab” would not be allowed.

5- The password must not contain more than one special character in a row. For example, “$$” would not be allowed. Repeating characters makes it easier for you to remember the password, but it also makes it easier for a computer to crack it.

6- The password must not begin or end with “!”. Additionally, ampersand (&) cannot be the first special character used in the password. However, it can be the second or subsequent special character used. “!” is one of the first characters on most keyboards so a lot of users will choose this as their first special character. This is known to hackers and therefore inherently weak. “&” is also very commonly used because it is both a special character and a replacement for one of the most used words in the English language.

7- The new password must be different from your last 10 passwords. Reusing passwords dramatically increases the risk of using a password that has been exposed in a data breach and is now known to hackers. Unless you are continually monitoring your passwords by checking them against known exposed passwords or continually checking data breach news, you may be unaware your password has been exposed.

8- Your new password must differ from your previous password by at least 8 characters. This was previously 4 characters. Changing a character from uppercase to lower case or vice versa satisfies the requirement for a change.

  • This requirement is an example of password similarity blocking (blocking new passwords that are too similar to old passwords).
  • People often try to slightly alter their previous password so that it’s just different enough to pass as a new password but remains virtually unchanged to the user.
  • This is common password creation behavior but it leads to poor password security.

9- Passwords are valid for 60 days and then must be changed. It’s advised that users should frequently change their password to reduce the risk of continually using an exposed password.

10- The use of dictionary words from any language is prohibited. This is because password cracking programs that can run through millions of words in a matter of seconds are in widespread use.

11- Passwords should be complex, but also easy to remember. Complexity in this context tends to mean an element of randomness – something that isn’t easy to decipher at a glance and would appear illogical to anyone reading it. It also means that you make good use of all the character sets available to you. Complex passwords are harder for computers to crack because the computer will have to run through many millions of combinations before arriving at the right one. This isn’t the case when you use simple passwords that are all in one case, use repeating character, or only use one type of character class.

  • For example, according to this password checking website, the password “chocolate” would be cracked instantly. However, it would take a computer 8 hours to crack “[email protected]”. Please note that this example is just to illustrate the reasoning behind the complexity and that “[email protected]” would not satisfy DIBBS requirements, nor would it be considered a particularly strong password.
  • So, how do you remember a legitimately complex password? The key to this is to use a set of rules that you can follow to always recall the password. DIBBS uses the following examples:
  • Ihl1Cf20#yNi$8# (I have lived in California for 20 years now and is great)
  • Msi5%Y0ld%ni$8# (My Son is 5 years old and is great)
  • You shouldn’t use these examples as your password, but you can use a similar formula to make your own.
  • It’s a good idea to pick a memorable sentence that you’re unlikely to forget.
  • The above examples are personal statements, something personal to you or your life that you can easily cement into your mind.
  • Another example of a personal statement could be something like “Don’t forget, Grandma’s birthday is on September 7th and she wants flowers, chocolate, and a card”, which would become “Df.gBi0S7aSwF.C.AaC.”
  • If you don’t want to use a personal statement, song lyrics or your favorite quote from a book or movie could work well here.

12- The use of personal information in passwords is prohibited. For example, names, telephone numbers, account names, and birthplaces are not allowed. Hackers understand that people often use personal information in passwords because it makes the password easier to remember. Learning this personal information is often the motivation behind phishing attacks. Put simply, unless it’s something ONLY you know, like the name of a pet spider you had when you were a kid that you never told a single soul about, you shouldn’t incorporate it into your password.

13- DIBBS also recommends that you should change passwords with Internet Explorer or Firefox to avoid possible issues.

Conclusion of the new DIBBS Password Format

The new DIBBS password format is attempting to make authentication more secure and while some of the requirements seem onerous, they can make passwords more secure. Beyond just the above password requirements, we would also recommend that screening passwords for exposure would be a logical next step.

Learn more about compromised password screening.

The post The New DIBBS Password Format Explained appeared first on Enzoic.


Recent Articles By Author
  • Four Tips for Companies During Data Privacy Week
  • Why You Need Continuous Password Monitoring for True Protection
  • Cyber Insurance is Becoming More Complex
More from Enzoic

*** This is a Security Bloggers Network syndicated blog from Enzoic authored by Enzoic. Read the original post at: https://www.enzoic.com/dibbs-password/

May 18, 2020May 18, 2020 Enzoic account takeover, DIBBS, DIBSS Password Format
  • ← 11-Plus Supercomputers Hacked With Cryptominers
  • Media Giant BBC Credits Digital Identity Strategy as One Key to Success During Pandemic →

Techstrong TV – Live

Click full-screen to enable volume control
Watch latest episodes and shows
TSTV Podcast

Subscribe to our Newsletters

Most Read on the Boulevard

Orgs Must Prepare for SEC Cybersecurity Requirements Aimed at Boards
US No-Fly List Leaked via Airline Dev Server by @_nyancrimew
Russia-Linked Attackers Target US Nuclear Research Facilities
What is PSaaS and is it Worthwhile?
The Security Challenges of API Sprawl
What Are Open Source Kubernetes Policy Engines? Why You Need One & How to Pick
Multi-factor Authentication
PayPal Breach 2023: Tip of the Iceberg
The cyber security environment in 2022- What did we learn?
Bots Are Now Robocalling to Phish For Your Two-Factor Authentication (2FA) Codes

Upcoming Webinars

Tue 31

Moving Beyond SBOMs to Secure the Software Supply Chain

January 31 @ 11:00 am - 12:00 pm
Tue 31

Live-Hacking Container Workloads on AWS

January 31 @ 1:00 pm - 2:00 pm
Feb 01

Achieving DevSecOps: Reducing AppSec Noise at Scale

February 1 @ 1:00 pm - 2:00 pm
Feb 13

AI in Machine Learning

February 13 @ 1:00 pm - 2:00 pm
Feb 15

Understanding Cyber Insurance Identity Security Requirements for 2023

February 15 @ 11:00 am - 12:00 pm
Feb 15

Where Will DevSecOps ‘Shift’ Next?

February 15 @ 1:00 pm - 2:00 pm
Feb 21

Headwinds, Crosswinds and Tailwinds: Securing the Cloud in Turbulent Times

February 21 @ 1:00 pm - 2:00 pm
Feb 22

Best Practices to Secure Your Software Supply Chain

February 22 @ 1:00 pm - 2:00 pm
Feb 28

SaaS-Based Container Networking and Security on Amazon EKS

February 28 @ 11:00 am - 12:00 pm

More Webinars

Download Free eBook

Managing the AppSec Toolstack

Industry Spotlight

US No-Fly List Leaked via Airline Dev Server by @_nyancrimew
Analytics & Intelligence API Security Application Security Cloud Security Cyberlaw Cybersecurity Data Security DevOps Editorial Calendar Featured Governance, Risk & Compliance Humor Identity & Access Incident Response Industry Spotlight Most Read This Week Network Security News Popular Post Security Boulevard (Original) Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

US No-Fly List Leaked via Airline Dev Server by @_nyancrimew

January 23, 2023 Richi Jennings | 4 days ago 0
T-Mobile’s SIXTH Breach in 5 years: 37M Users’ PII Leaks
Analytics & Intelligence API Security Careers Cloud Security Cyberlaw Cybersecurity Data Security DevOps Editorial Calendar Featured Governance, Risk & Compliance Humor Identity & Access Incident Response Industry Spotlight Mobile Security Most Read This Week Network Security News Popular Post Security Awareness Security Boulevard (Original) Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

T-Mobile’s SIXTH Breach in 5 years: 37M Users’ PII Leaks

January 20, 2023 Richi Jennings | Jan 20 0
APIs in Vehicle Software Vulnerable to Attacks
API Security Application Security Cybersecurity Data Security Featured Industry Spotlight Malware Security Boulevard (Original) Threat Intelligence Vulnerabilities 

APIs in Vehicle Software Vulnerable to Attacks

January 18, 2023 Sue Poremba | Jan 18 0

Top Stories

Chainguard Unveils Memory-Safe Linux Distribution
Application Security Cybersecurity Featured Mobile Security Network Security News Security Awareness Security Boulevard (Original) Spotlight 

Chainguard Unveils Memory-Safe Linux Distribution

January 27, 2023 Michael Vizard | Yesterday 0
‘Hive’ Russian Ransomware Gang Shut Down by FBI, DoJ, Europol, Bundeskriminalamt, et al
Analytics & Intelligence Application Security Cloud Security Cyberlaw Cybersecurity Data Security Endpoint Featured Governance, Risk & Compliance Humor Identity & Access Incident Response Malware Mobile Security Most Read This Week Network Security News Popular Post Security Awareness Security Boulevard (Original) Social Engineering Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

‘Hive’ Russian Ransomware Gang Shut Down by FBI, DoJ, Europol, Bundeskriminalamt, et al

January 27, 2023 Richi Jennings | Yesterday 0
More Details of LastPass Breach: Hackers Used Stolen Encryption Key
Analytics & Intelligence Cloud Security Cybersecurity Data Security Featured Governance, Risk & Compliance Identity & Access Incident Response News Security Boulevard (Original) Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

More Details of LastPass Breach: Hackers Used Stolen Encryption Key

January 27, 2023 Teri Robinson | Yesterday 0

Security Humor

‘Hive’ Russian Ransomware Gang Shut Down by FBI, DoJ, Europol, Bundeskriminalamt, et al

‘Hive’ Russian Ransomware Gang Shut Down by FBI, DoJ, Europol, Bundeskriminalamt, et al

Security Boulevard Logo White

DMCA

Join the Community

  • Add your blog to Security Bloggers Network
  • Write for Security Boulevard
  • Bloggers Meetup and Awards
  • Ask a Question
  • Email: [email protected]

Useful Links

  • About
  • Media Kit
  • Sponsor Info
  • Copyright
  • TOS
  • DMCA Compliance Statement
  • Privacy Policy

Related Sites

  • Techstrong Group
  • Container Journal
  • DevOps.com
  • Digital CxO
  • Techstrong Research
  • Techstrong TV
  • Techstrong.tv Podcast
  • DevOps Chat
  • DevOps Dozen
  • DevOps TV
Powered by Techstrong Group
Copyright © 2023 Techstrong Group Inc. All rights reserved.