In early September 2019, the DLA Internet Bid Board System (DIBBS) implemented new password requirements in line with the updated Department of Defence (DoD) security requirements. As a portal for contractors to submit quotes and proposals to the Defence Logistics Agency (DLA), DIBBS is home to potentially sensitive information that must be protected with robust cybersecurity measures. The September 2019 update reflects this by introducing new requirements to strengthen security.

Let’s take a look at the new DIBBS password format as well as the reasoning behind any changes. It’s important to note that any attempts we make to explain the logic behind changes to the password rules didn’t come from DIBBS or any other US government agency. Instead, our reasoning is based on current cybersecurity best practices within the industry.

New DIBBS Password Format

1- Your password must be a minimum of 15 characters long and a maximum of 60 characters long. When it comes to passwords, longer is better. Increasingly the length of your password dramatically increases the time it will take to crack it.

2- Your password must contain at least 2 characters from each of the following 4 character classes listed below:

• English Upper Case Letters: ABCDEFGHIJKLMNOPQRSTUVWXYZ
• English Lower Case Letters: abcdefghijklmnopqrstuvwxyz
• Westernized Arabic Numerals: 0123456789
• Non-alphanumeric (special characters) @ # $ % ^ & + . = !

3- Your password must not have more than 4 Upper and Lower case letters in a row. Additionally, no more than 4 numbers in a row are allowed.

4- The first three characters of the password must be different from each other. For example, “thb” or “abc” would be allowed, but “jjj”, “aab”, or “bab” would not be allowed.

5- The password must not contain more than one special character in a row. For example, “$$” would not be allowed. Repeating characters makes it easier for you to remember the password, but it also makes it easier for a computer to crack it.

6- The password must not begin or end with “!”. Additionally, ampersand (&) cannot be the first special character used in the password. However, it can be the second or subsequent special character used. “!” is one of the first characters on most keyboards so a lot of users will choose this as their first special character. This is known to hackers and therefore inherently weak. “&” is also very commonly used because it is both a special character and a replacement for one of the most used words in the English language.

7- The new password must be different from your last 10 passwords. Reusing passwords dramatically increases the risk of using a password that has been exposed in a data breach and is now known to hackers. Unless you are continually monitoring your passwords by checking them against known exposed passwords or continually checking data breach news, you may be unaware your password has been exposed.

8- Your new password must differ from your previous password by at least 8 characters. This was previously 4 characters. Changing a character from uppercase to lower case or vice versa satisfies the requirement for a change.

• This requirement is an example of password similarity blocking (blocking new passwords that are too similar to old passwords).
• People often try to slightly alter their previous password so that it’s just different enough to pass as a new password but remains virtually unchanged to the user.
• This is common password creation behavior but it leads to poor password security.

9- Passwords are valid for 60 days and then must be changed. It’s advised that users should frequently change their password to reduce the risk of continually using an exposed password.

10- The use of dictionary words from any language is prohibited. This is because password cracking programs that can run through millions of words in a matter of seconds are in widespread use.

11- Passwords should be complex, but also easy to remember. Complexity in this context tends to mean an element of randomness – something that isn’t easy to decipher at a glance and would appear illogical to anyone reading it. It also means that you make good use of all the character sets available to you. Complex passwords are harder for computers to crack because the computer will have to run through many millions of combinations before arriving at the right one. This isn’t the case when you use simple passwords that are all in one case, use repeating characters, or only use one type of character class.

• For example, according to this password checking website, the password “chocolate” would be cracked instantly. However, it would take a computer 8 hours to crack “cHoC0L@tE”. Please note that this example is just to illustrate the reasoning behind the complexity and that “cHoC0L@tE” would not satisfy DIBBS requirements, nor would it be considered a particularly strong password.
• So, how do you remember a legitimately complex password? The key to this is to use a set of rules that you can follow to always recall the password. DIBBS uses the following examples:
• Ihl1Cf20#yNi$8# (I have lived in California for 20 years now and is great)
• Msi5%Y0ld%ni$8# (My Son is 5 years old and is great)
• You shouldn’t use these examples as your password, but you can use a similar formula to make your own.
• It’s a good idea to pick a memorable sentence that you’re unlikely to forget.
• The above examples are personal statements, something personal to you or your life that you can easily cement into your mind.
• Another example of a personal statement could be something like “Don’t forget, Grandma’s birthday is on September 7th and she wants flowers, chocolate, and a card”, which would become “Df.gBi0S7aSwF.C.AaC.”
• If you don’t want to use a personal statement, song lyrics or your favorite quote from a book or movie could work well here.

12- The use of personal information in passwords is prohibited. For example, names, telephone numbers, account names, and birthplaces are not allowed. Hackers understand that people often use personal information in passwords because it makes the password easier to remember. Learning this personal information is often the motivation behind phishing attacks. Put simply, unless it’s something ONLY you know, like the name of a pet spider you had when you were a kid that you never told a single soul about, you shouldn’t incorporate it into your password.

13- DIBBS also recommends that you should change passwords with Internet Explorer or Firefox to avoid possible issues.

Conclusion of the new DIBBS Password Format

The new DIBBS password format is attempting to make authentication more secure and while some of the requirements seem onerous, they can make passwords more secure. Beyond just the above password requirements, we would also recommend that screening passwords for exposure would be a logical next step.

Learn more about compromised password screening.