Why Length Beats Complexity for Today’s Businesses
Long passphrases provide stronger protection and easier usability than outdated complexity rules, as recommended by NIST.
Businesses often believe adding symbols and monthly password resets makes them secure. NIST’s latest guidance says otherwise: a long, easy‑to‑remember passphrase offers more real protection than complexity tricks.
Password Style
Example Password
Notes on Strength and Usability
Old Complexity Rule (Outdated)
Tr@v3l!92
Short, hard to remember; may be reused or written down; easier for automated attacks to guess.
Old Complexity Rule (Outdated)
Pa$$w0rd!
Common pattern, predictable substitutions (“a”→“@”, “s”→“$”); easily cracked despite complexity.
Old Complexity Rule (Outdated)
M1cR0#Biz
Limited entropy due to short length; users frequently forget or reuse similar versions.
Modern NIST Approach (Recommended)
coffeeandcodeinthefall
Long, natural phrase; easy to remember; high entropy from length and unpredictability.
Modern NIST Approach (Recommended)
mydoglovesthebeachwalks
Secure through length, words chosen personally; human‑friendly without sacrificing strength.
Modern NIST Approach (Recommended)
sevencloudsdriftbyslowlytoday
Strong against brute‑force attacks because of sheer character count and mixed word structure.
Action Steps for Business Owners
Update Your Security Policy: Review password guidelines against NIST SP 800‑63B. Shift to length‑based passphrases.
Use Professional Password Management: Centralize storage and compliance while simplifying employee access.
Add Multifactor Authentication: Combine long passwords with MFA for the strongest possible protection.
Educate Staff Regularly: Train teams to create strong, unique passphrases and spot common cyber threats.
Monitor Access: Implement logging and alerts for suspicious password usage or failed login attempts.
Client Q&A
Q: Why did NIST change its recommendations? A: Research showed that complexity rules lead to bad habits — predictable substitutions and reused passwords — while longer ones resist attacks better.
Q: Do these changes apply to small businesses? A: Yes, small firms face the same credential attacks big ones do. NIST’s standards are scalable and easy to implement.
Q: How can I simplify all this? A: Centralized password management enforces standards automatically and keeps credentials secure without manual oversight.
How Farmhouse Networking Can Help
Farmhouse Networking works with SMBs to implement secure password policy frameworks based on NIST, automate credential management, and train users. Our goal: reduce risk, improve productivity, and strengthen compliance.
How to Take Back Control of Your Credentials and Phones
When an MSP controls your passwords and phone system, your entire small business can be held hostage by vendor lock‑in and security risks.
If your MSP controls all your admin passwords and has your phone service in their name, they effectively hold the keys to your entire business. In a dispute, a security incident, or even an acquisition of their company, you could find yourself locked out of critical systems that drive revenue and customer service.
The Real Dangers of MSP Lock‑In
Some providers refuse to release credentials or slow‑roll off‑boarding, forcing clients into “hostage” situations that require legal escalation or aggressive technical takeovers. At the same time, attackers increasingly target MSPs because one compromised technician account can reach many customers’ environments.
When your phone system is outdated or fully tied to that MSP, you pay more each year for less functionality, struggle with remote work, and depend on them for every change. The combination of technical dependence and credential lock‑in is a business‑continuity risk you can’t afford to ignore.
Action Steps for Owners and Their IT Teams
Reassert ownership of core assets
Ensure your company owns master accounts for email, cloud services, line‑of‑business apps, domains, DNS, and phone numbers, with internal admin rights documented.
Centralize credentials in a business‑owned vault
Use a secure password manager or encrypted repository where your business controls the master key and you grant time‑bound, role‑based access to MSP staff.
Implement strong identity and access controls
Enforce MFA everywhere, require strong unique passwords, and use least‑privilege and role‑based access so no external user has unchecked power.
Build clean exit ramps into contracts
Document how credentials, documentation, and phone services will be handed back, and set deadlines and formats for off‑boarding deliverables.
Prepare for the worst‑case scenario
Maintain independent backups, keep an internal “break‑glass” account, and have a written playbook for revoking vendor access and rotating credentials quickly.
Questions Your Customers May Ask
Q: Could your IT company access or leak my data? A: We control the master credentials and use MFA, logging, and access controls so any vendor only has tightly scoped, monitored access to what they need to support us.
Q: What happens if your IT provider is hacked? A: We follow best practices for identity security, vendor risk management, and backups so a single compromised account at an MSP cannot easily cascade into your data.
Q: Are you able to stay operational if you change IT providers? A: Yes—because we own our accounts and phone numbers and have a documented exit process, we can transition providers while keeping systems and support running.
How Farmhouse Networking Helps SMBs
Farmhouse Networking works with business owners to document every critical system, transfer licensing and phone services into the company’s control, and consolidate credentials into secure, business‑owned vaults. We then implement MFA, break glass accounts, role‑based access, and incident‑response plans so neither a single technician nor an MSP relationship becomes a single point of failure.
We can also help you renegotiate or replace MSP contracts with clear off‑boarding terms and test those processes before you ever need them in an emergency.
Email support@farmhousenetworking.com to make sure no MSP can ever hold your credentials, phones, or business hostage again.
Farmhouse Networking implements zero trust password management with passwordless MFA for secure Grants Pass business cloud access.
This is the fifth in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on password management.
Password Management
Password management is the concept that you are not using the same password for all sites and services. So it is necessary to have a means to track and protect those passwords from others accessing or using them without consent. Here are some questions that you should be asking yourself:
How do you keep track of passwords? paper? spreadsheet? program?
Are your passwords encrypted? Are they guessable? Are they changed regularly?
Do you have a password policy?
What do you do when someone leaves the company?
Do you take advantage of 2FA or MFA?
Do you take advantage of single sign-on?
Take time to think about these questions and decide where changes can be made to better protect your passwords, or contact us to do the thinking for you.
Single secure vault eliminates password sprawl across business apps
Whether you are buying something from an online store, reading your email in the browser, checking your account balances, or uploading photos / videos to social media, most websites require an individual username and password when accessing their services. This raises various problems.
What’s with ALL the Passwords?
Using the same password for all the websites you access is a bad idea and horribly insecure. If we run a quick check on the “Dark Web” for your email address, it would likely show that hackers already know the one password you have been using forever. So the only other option is multiple passwords, which can easily go beyond the limits of our feeble human brains to keep track of OR people start creating a list that is typically typed up and saved on the computer – if a hacker gets into the computer then all the passwords are theirs too. So then the option is to find a secure way of storing and backing up these passwords, not to mention trying to make them easy to use.
Rangle Them Passwords!
That is the job of Password Management done by a small piece of software known as a password manager. It takes the complexity down to remembering the one password to open the software, then it tracks the rest from there. The good ones have the ability to generate passwords for you, store them in connection with the website you are visiting, auto-filling the password fields on the websites when you visit them again, and backup your passwords to the cloud – all with strong security and encryption to keep the hackers out of your business.
If your company is still typing passwords into a list, or worse have a paper list, then contact us for assistance migrating to a password manager.
Unlock strong, memorable passwords: Use 5-7 random words for SMB security—simple, effective, and Farmhouse Networking approved.
The COVID-19 scare and ensuing rush to remote access has us thinking security. What is more basic to security than passwords. In an effort to find a way to make passwords both secure and easy to remember, I have found a website that seems to fit the bill:
The concept is surprisingly simple and is said to be based on a cartoon:
I have played with the settings and found the following to generate some good password settings. Here they are for those who are interested:
The only other option would be to use random passwords stored in a password keeper. This also allows secure sharing of passwords throughout the organization.
If your company is using remote access, then contact us for assistance to make it secure.
Farmhouse Networking has had a long standing policy that we do not keep a record of client passwords (except when needed for device administration). That is about to change, but before we talk about our new password policy let’s talk password storage:
Common Password Storage
Here are some popular places where many businesses store their passwords that make them very vulnerable to being stolen.
Passwords written on paper (that are not under lock and key):
On your desk under your keyboard (or taped underneath)
Under your stapler or desk decorations
On sticky notes stuck to your monitor or desk
On a scrap of paper on your desk or in a drawer
In a notebook or address book
In a old-fashioned Rolodex file
Paper printouts or photocopies of your passwords
Anyone with access to your office could easily find and steal passwords stored like this.
Passwords stored in your computer (without using encryption):
Remembered in your web browser
A document called “Passwords” that you’ve created anywhere on your computer, perhaps using Microsoft Word or Excel
A document with any other name on your computer (including the password as the name)
Email drafts that you’ve created (but not sent) containing password information
Anyone with access to your computer could easily find and steal passwords stored like this, including both a person with physical access to it as well as a virus or hacker gaining access via the internet, or scamming you into granting them access, even once.
Passwords stored in your smartphone or tablet (without using encryption):
Electronic “Notes” containing password information
Other documents or emails similar to the ones listed in computer storage above
Anyone with access to your device could easily find and steal passwords stored like this.
Passwords sent via regular (insecure) email:
Emails that you have sent to yourself containing password information
Emails that you have sent to anyone else containing password information
Any information that you send using regular (unencrypted) email puts that information at risk of being stolen. Email is neither private nor secure. Sending an email is like mailing a postcard, and hackers and thieves can easily read the contents. You should never send passwords (or any other confidential or sensitive data) via regular email.
Secure Password Storage
Now for the discussion of Farmhouse Networking’s new password policy. We are partnering with a company to provide a storage of passwords and other client documentation with military grade encryption. This partnership also allows us to address the dangers that common password storage present by offering our clients this same encrypted password storage service. Here are some of the benefits of this service:
Unlimited users
Unlimited passwords
Each user has a personal password vault
Shared company password vault
Security groups to manage access
Auditing & reporting (Compliance)
Secure password sharing
1-Click Login Tool (for all major browsers)
Mobile Device Access
Only $15 per month (Compared to Lastpass Business at $4 per user per month)
If your company is using common password storage of any kind do yourself a security favor and contact us to upgrade to secure password storage.
And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
