Tuesday, April 20, 2021
  • Fugue Adds Google Cloud Support to its Multi-Cloud Security Platform
  • Fugue Adds Google Cloud Support to its Multi-Cloud Security Platform
  • The Importance of Uptime and Performance in Cloud Security
  • 6 Stages of Risk and Compliance Program Maturity and the Opportunities for Automation
  • Breaking the Phishing Kill Chain

Security Boulevard

The Home of the Security Bloggers Network

Community Chats Webinars Library
  • Home
    • Cybersecurity News
    • Features
    • Industry Spotlight
    • News Releases
  • Security Bloggers Network
    • Latest Posts
    • Contributors
    • Syndicate Your Blog
    • Write for Security Boulevard
  • Webinars
    • Upcoming
    • On-Demand
  • Chat
    • Security Boulevard Chat
    • Marketing InSecurity Podcast
  • Library
  • Related Sites
    • MediaOps Inc.
    • DevOps.com
    • Container Journal
    • Digital Anarchist
    • SweetCode.io
  • Media Kit

  • Analytics
  • AppSec
  • CISO
  • Cloud
  • DevOps
  • GRC
  • Identity
  • Incident Response
  • IoT / ICS
  • Threats / Breaches
  • More
    • Blockchain / Digital Currencies
    • Careers
    • Cyberlaw
    • Mobile
    • Social Engineering
  • Humor
Security Bloggers Network 

Home » Security Bloggers Network » The New DIBBS Password Format Explained

The New DIBBS Password Format Explained

by Enzoic on May 18, 2020

In early September 2019, the DLA Internet Bid Board System (DIBBS) implemented new password requirements in line with the updated Department of Defence (DoD) security requirements. As a portal for contractors to submit quotes and proposals to the Defence Logistics Agency (DLA), DIBBS is home to potentially sensitive information that must be protected with robust cybersecurity measures. The September 2019 update reflects this by introducing new requirements to strengthen security.

Let’s take a look at the new DIBBS password format as well as the reasoning behind any changes. It’s important to note that any attempts we make to explain the logic behind changes to the password rules didn’t come from DIBBS or any other US government agency. Instead, our reasoning is based on current cybersecurity best practices within the industry.

New DIBBS Password Format

1- Your password must be a minimum of 15 characters long and a maximum of 60 characters long. When it comes to passwords, longer is better. Increasingly the length of your password dramatically increases the time it will take to crack it.

2- Your password must contain at least 2 characters from each of the following 4 character classes listed below:

  • English Upper Case Letters: ABCDEFGHIJKLMNOPQRSTUVWXYZ
  • English Lower Case Letters: abcdefghijklmnopqrstuvwxyz
  • Westernized Arabic Numerals: 0123456789
  • Non-alphanumeric (special characters) @ # $ % ^ & + . = !

3- Your password must not have more than 4 Upper and Lower case letters in a row. Additionally, no more than 4 numbers in a row are allowed.

4- The first three characters of the password must be different from each other. For example, “thb” or “abc” would be allowed, but “jjj”, “aab”, or “bab” would not be allowed.

5- The password must not contain more than one special character in a row. For example, “$$” would not be allowed. Repeating characters makes it easier for you to remember the password, but it also makes it easier for a computer to crack it.

6- The password must not begin or end with “!”. Additionally, ampersand (&) cannot be the first special character used in the password. However, it can be the second or subsequent special character used. “!” is one of the first characters on most keyboards so a lot of users will choose this as their first special character. This is known to hackers and therefore inherently weak. “&” is also very commonly used because it is both a special character and a replacement for one of the most used words in the English language.

7- The new password must be different from your last 10 passwords. Reusing passwords dramatically increases the risk of using a password that has been exposed in a data breach and is now known to hackers. Unless you are continually monitoring your passwords by checking them against known exposed passwords or continually checking data breach news, you may be unaware your password has been exposed.

8- Your new password must differ from your previous password by at least 8 characters. This was previously 4 characters. Changing a character from uppercase to lower case or vice versa satisfies the requirement for a change.

  • This requirement is an example of password similarity blocking (blocking new passwords that are too similar to old passwords).
  • People often try to slightly alter their previous password so that it’s just different enough to pass as a new password but remains virtually unchanged to the user.
  • This is common password creation behavior but it leads to poor password security.

9- Passwords are valid for 60 days and then must be changed. It’s advised that users should frequently change their password to reduce the risk of continually using an exposed password.

10- The use of dictionary words from any language is prohibited. This is because password cracking programs that can run through millions of words in a matter of seconds are in widespread use.

11- Passwords should be complex, but also easy to remember. Complexity in this context tends to mean an element of randomness – something that isn’t easy to decipher at a glance and would appear illogical to anyone reading it. It also means that you make good use of all the character sets available to you. Complex passwords are harder for computers to crack because the computer will have to run through many millions of combinations before arriving at the right one. This isn’t the case when you use simple passwords that are all in one case, use repeating character, or only use one type of character class.

  • For example, according to this password checking website, the password “chocolate” would be cracked instantly. However, it would take a computer 8 hours to crack “cHoC0L@tE”. Please note that this example is just to illustrate the reasoning behind the complexity and that “cHoC0L@tE” would not satisfy DIBBS requirements, nor would it be considered a particularly strong password.
  • So, how do you remember a legitimately complex password? The key to this is to use a set of rules that you can follow to always recall the password. DIBBS uses the following examples:
  • Ihl1Cf20#yNi$8# (I have lived in California for 20 years now and is great)
  • Msi5%Y0ld%ni$8# (My Son is 5 years old and is great)
  • You shouldn’t use these examples as your password, but you can use a similar formula to make your own.
  • It’s a good idea to pick a memorable sentence that you’re unlikely to forget.
  • The above examples are personal statements, something personal to you or your life that you can easily cement into your mind.
  • Another example of a personal statement could be something like “Don’t forget, Grandma’s birthday is on September 7th and she wants flowers, chocolate, and a card”, which would become “Df.gBi0S7aSwF.C.AaC.”
  • If you don’t want to use a personal statement, song lyrics or your favorite quote from a book or movie could work well here.

12- The use of personal information in passwords is prohibited. For example, names, telephone numbers, account names, and birthplaces are not allowed. Hackers understand that people often use personal information in passwords because it makes the password easier to remember. Learning this personal information is often the motivation behind phishing attacks. Put simply, unless it’s something ONLY you know, like the name of a pet spider you had when you were a kid that you never told a single soul about, you shouldn’t incorporate it into your password.

13- DIBBS also recommends that you should change passwords with Internet Explorer or Firefox to avoid possible issues.

Conclusion of the new DIBBS Password Format

The new DIBBS password format is attempting to make authentication more secure and while some of the requirements seem onerous, they can make passwords more secure. Beyond just the above password requirements, we would also recommend that screening passwords for exposure would be a logical next step.

Learn more about compromised password screening.

The post The New DIBBS Password Format Explained appeared first on Enzoic.


Recent Articles By Author
  • Can AI be Used to Mitigate Human Error?
  • Attacks on Digital Learning
  • How Social Engineering Tactics Can Crack Multi-factor Authentication
More from Enzoic

*** This is a Security Bloggers Network syndicated blog from Enzoic authored by Enzoic. Read the original post at: https://www.enzoic.com/dibbs-password/

May 18, 2020May 18, 2020 Enzoic account takeover, DIBBS, DIBSS Password Format
  • ← 11-Plus Supercomputers Hacked With Cryptominers
  • Media Giant BBC Credits Digital Identity Strategy as One Key to Success During Pandemic →

TechStrong TV – Live

Watch latest episodes and shows

Subscribe to our Newsletters

Get breaking news, free eBooks and upcoming events delivered to your inbox.
  • View Security Boulevard Privacy Policy

Most Read on the Boulevard

Wordsmithing: Cybersecurity or Cyber Safety?
U.S. Fingers Putin’s Cozy Bear for SolarWinds Attacks
Emotet Takedown: Time to Celebrate?
New Federal Data Privacy Legislation Proposed
Clubhouse Exclusivity Applies to Membership, Not Data
Cloud Identity and Access Management Alphabet Soup: A Definitive Guide
Securing APIs: Empowering Security
Phishing 101: How It Works & What to Look For
CISO Stories Podcast: Is There a Magic Security Control List?
Are Banks Spending Their Cybersecurity Budgets in the Right Place?

Upcoming Webinars

Wed 21

Managing Open Policy Agent at Scale

April 21 @ 3:00 pm - 4:00 pm
Thu 22

A New Approach to Secure Web Gateways

April 22 @ 11:00 am - 12:00 pm
Mon 26

The Kubernetes Network (Security) Effect

April 26 @ 9:00 am - 10:00 am
Mon 26

Application Security: Moving at the Speed of DevOps

April 26 @ 1:00 pm - 2:00 pm
Wed 28

Cyber Attacks From the Open Source Perspective

April 28 @ 1:00 pm - 2:00 pm
Thu 29

Hack My Java Application: How Snyk and Red Hat Help Developers Stay Performant and Secure

April 29 @ 11:00 am - 12:00 pm
May 05

Managing Permissions and Entitlements is at the Core of a Zero Trust Model in the Cloud

May 5 @ 3:00 pm - 4:00 pm
May 17

Are We There Yet? The State of Cloud Native Application Security

May 17 @ 9:00 am - 10:00 am

More Webinars

Download Free eBook

The State of Cloud Native Security 2020

Recent Security Boulevard Chats

  • Cloud, DevSecOps and Network Security, All Together?
  • Security-as-Code with Tim Jefferson, Barracuda Networks
  • ASRTM with Rohit Sethi, Security Compass
  • Deception: Art or Science, Ofer Israeli, Illusive Networks
  • Tips to Secure IoT and Connected Systems w/ DigiCert

Industry Spotlight

Taking Steps Toward an Impactful SASE Architecture
Cybersecurity Data Security Endpoint Industry Spotlight Network Security Security Boulevard (Original) 

Taking Steps Toward an Impactful SASE Architecture

April 20, 2021 Mike Spanbauer | 5 hours ago 0
Online Ed is the New Corporate Threat Vector
Cybersecurity Governance, Risk & Compliance Industry Spotlight Malware Security Boulevard (Original) Threats & Breaches 

Online Ed is the New Corporate Threat Vector

April 19, 2021 Curtis Simpson | Yesterday 0
Three Wishes to Revitalize SIEM and Your SOC
Cybersecurity Data Security Endpoint Industry Spotlight Network Security Security Boulevard (Original) 

Three Wishes to Revitalize SIEM and Your SOC

April 16, 2021 Albert Zhichun Li | 4 days ago 0

Top Stories

U.S. Fingers Putin’s Cozy Bear for SolarWinds Attacks
Analytics & Intelligence Application Security Cloud Security Cyberlaw Cybersecurity Data Security Endpoint Featured Governance, Risk & Compliance Incident Response IoT & ICS Security Malware Network Security News Security Boulevard (Original) Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

U.S. Fingers Putin’s Cozy Bear for SolarWinds Attacks

April 16, 2021 Richi Jennings | 3 days ago 0
YT$AW: FBI Cleans Up Exchange Servers, NSA Tips Microsoft 4 More Bugs
Analytics & Intelligence Cloud Security Cyberlaw Cybersecurity Data Security Endpoint Featured Governance, Risk & Compliance Incident Response Malware Network Security News Security Awareness Security Boulevard (Original) Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

YT$AW: FBI Cleans Up Exchange Servers, NSA Tips Microsoft 4 More Bugs

April 14, 2021 Richi Jennings | Apr 14 0
Son of Stuxnet? Iran Nuke Site Hacked ‘by Israel’ (Again)
Analytics & Intelligence Application Security AppSec Cyberlaw Cybersecurity Deep Fake and Other Social Engineering Tactics Endpoint Featured Governance, Risk & Compliance Identity & Access Identity and Access Management Incident Response IoT & ICS Security Malware Network Security News Securing the Edge Security Awareness Security Boulevard (Original) Social Engineering Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

Son of Stuxnet? Iran Nuke Site Hacked ‘by Israel’ (Again)

April 12, 2021 Richi Jennings | Apr 12 0

Security Humor

via   the respected information security capabilities of   Robert M. Lee     & the superlative illustration talents of   Jeff Haas   at   Little Bobby Comics

Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 325’

Join the Community

  • Add your blog to Security Bloggers Network
  • Write for Security Boulevard
  • Bloggers Meetup and Awards
  • Ask a Question
  • Email: info@securityboulevard.com

Useful Links

  • About
  • Media Kit
  • Sponsors Info
  • Copyright
  • TOS
  • Privacy Policy
  • DMCA Compliance Statement

Other Mediaops Sites

  • Container Journal
  • DevOps.com
  • DevOps Connect
  • DevOps Institute
Copyright © 2021 MediaOps Inc. All rights reserved.
Our website uses cookies. By continuing to browse the website you are agreeing to our use of cookies. For more information on how we use cookies and how you can disable them, please read our Privacy Policy.