2 cissp ® Official Study Guide Eighth Edition

Password History
Many users get into the habit of rotating between two passwords. A 
password history remembers a certain number of previous passwords and prevents users 
from reusing a password in the history. This is often combined with a minimum password 
age setting, preventing users from changing a password repeatedly until they can set the 
password back to the original one. Minimum password age is often set to one day.
Users often don’t understand the need for strong passwords. Even when they do, they 
often don’t know to create strong passwords that they can easily remember. The following 
suggestions can help them create strong passwords:
■
Do not use any part of your name, logon name, email address, employee number, 
national identification number or social security number, phone number, extension, or 
any other identifying name or code.

---

Comparing Identification and Authentication 
591
■
Do not use information available from social network profiles such as a family mem-
ber’s name, a pet’s name, or your birth date. 
■
Do not use dictionary words (including words in foreign dictionaries), slang, or indus-
try acronyms. 
■
Do use nonstandard capitalization and spelling, such as stRongsecuRitee instead of 
strongsecurity. 
■
Do replace letters with special characters and numbers, such as stR0ng$ecuR1tee 
instead of strongsecurity.
In some environments, systems create initial passwords for user accounts automatically. 
Often the generated password is a form of a composition password, which includes two or 
more unrelated words joined together with a number or symbol in between. Composition 
passwords are easy for computers to generate, but they should not be used for extended 
periods of time because they are vulnerable to password-guessing attacks.