Coalition of nonprofit organizations releases the second version of the Common Guidance on Passwords with 132 signatories globally. 

November 12, 2024 – Safeguarding your online identity and data has never been more critical. “More Than A Password Day” is a global movement to emphasize the importance of stronger online authentication and gather support for an essential password guidance for businesses and individuals.

The Urgent Need for Stronger Authentication

Recent data from the 2024 Cyber Readiness Institute (CRI) global survey reveals that awareness and implementation of multi-factor authentication (MFA) remains dismally low among small and medium-sized businesses (SMBs). Nearly six out of ten SMBs (58%) remain unaware of MFA’s essential role in cybersecurity and only 35% worldwide have implemented MFA, leaving millions of accounts unprotected and vulnerable to unauthorized access. Additionally, fewer than one in five SMBs enforce MFA requirements internally, and a staggering 85% of SMBs do not require it for third-party partners, suppliers, or customers accessing their systems—an oversight that amplifies their exposure to potential breaches. (Link to the CRI report) 

“More Than A Password Day” is not just a reminder, but a call to action. With identity-based threats soaring and legitimate credentials accounting for more than half of cyberattacks on vital infrastructure, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), it is imperative that businesses act to protect themselves and their stakeholders.

This year’s More Than A Password Day represents a critical juncture to adopt stronger identity governance practices and encourage widespread MFA implementation. Beyond the dissemination of good practices, this year we welcome the enforcement of MFA on new platforms.

“In today’s landscape, identity threats continue to rise, and it’s critical that we embrace multi-factor authentication and proactive identity governance measures to stay ahead of attackers. “More Than A Password Day” calls on every organization to reflect on and strengthen its identity protection strategies—not only to safeguard their systems but to protect the privacy and trust of their users and customers. Today, we’re taking the first steps towards mandatory multi-factor authentication for all OWASP accounts,” said Andrew van der Stock, Executive Director at OWASP Foundation. “

Updating Common Guidance on Passwords

Nonprofit Cyber today releases an updated version of the Protecting Your Accounts and Devices: Common Guidance on Passwords. These comprehensive recommendations are designed to provide individuals and small businesses with accessible and actionable steps to enhance their online security. 

The Common Guidance on Passwords has already been endorsed by 132 organizations worldwide. Signatories include nonprofit cybersecurity and privacy organizations, companies, intergovernmental organizations, and government organizations themselves. We urge others to sign up to and implement this guidance.

Key Highlights of the Common Guidance

• Use Password-Free Authentication: Opt for password-free (passwordless) authentication, such as passkeys. Passkeys are not only simpler to use but also more secure than traditional passwords.

• Secure Your Email Account: If using password authentication for email accounts, use a very strong password and multi-factor authentication.

• Add an Extra Layer of Security: Employ a hardware security key, authenticator app, or PIN via SMS as a “second factor” in addition to your password.

• Use a Password Manager: A password manager can help you create and store strong passwords for all of your online accounts.

• Use Recommended Techniques to Pick Passwords: Select strong and memorable passwords through techniques like passphrases or the “Three Random Words” method.

• If You Are Hacked: Promptly change passwords if any of your devices are compromised or if an online service you use is hacked. Avoid reusing passwords and consider subscribing to services like https://haveibeenpwned.com/.

Join the Global Movement

“More Than A Password Day” is not merely an observance; it is a global movement. Individuals, organizations, and communities worldwide are encouraged to participate by taking actions that make protecting online accounts and devices more secure, such as raising awareness, regular membership or stakeholder communications, and implementing the use of stronger authentication methods.

“More Than A Password Day isn’t just about a single day of awareness—it’s about an ongoing commitment to improving digital security for everyone. It’s a shared responsibility, and today is a great reminder of the impact we can make together,” said Tony Sager, Co-Chair of Nonprofit Cyber and Senior VP at the Center for Internet Security. 

This global effort spearheaded by Nonprofit Cyber aims to empower all individuals and small businesses to fortify their online security, contributing to a safer digital ecosystem for everyone.

Join #MoreThanAPasswordDay, and together, let’s redefine online security for a safer digital world. 

Learn More

For detailed information on “More Than A Password Day” and access to the “Common Guidance on Passwords,” please visit https://nonprofitcyber.org/common-guidance-on-passwords/. 

About Nonprofit Cyber

Nonprofit Cyber is a coalition of global nonprofit organizations formed to enhance joint action to improve cybersecurity. All coalition members are nonprofits that serve the public interest by developing, sharing, deploying, and increasing the awareness of cybersecurity best practices, tools, standards, and services.

Learn more at https://nonprofitcyber.org/. 

Media Contact

Ms. Kayle Giroud,  Global Cyber Alliance and Nonprofit Cyber Secretariat, kgiroud@globalcyberalliance.org