Posts

Recommended practices – Part-3: Password security

/in /by

This is a multi-part series on recommended practices for organizations and their end-users.  Additional parts will be included in upcoming newsletters.

October is National Cybersecurity Awareness Month, and to help you celebrate, we have compiled a list of best practices for password-strength optimization.

Passwords are the primary tool for online authentication; as such, they are targeted information for cybercriminals looking to gain access to your workstation, mobile device, and/or personal records.  Proactive measures are vital to prevent online identity theft, network infiltration, system crashes, and the spread of malware.  By following the practices described below you will fortify yourself against these malicious cyber threats.

1. Create a “strong” password:

A strong password is one that cannot be easily identified by a cybercriminal.  When creating your next password, here are the do’s and do not’s of password strength:

  • Do not draw from the obvious: When selecting a password, do not draw from obvious sources – your name, your child’s name, not even something as seemingly ambiguous as your favorite flavor of ice cream or a random word.  With social media, today’s cybercriminal can easily aggregate personal information and crack obvious passwords.  Even if you feel that your password is obscure and/or unconnected to yourself, if the password is simply a word or phrase, dictionary attacks – programs that plug in every word from a database – can still compromise you.
  • Do use a mixture of letters, numbers, and special characters: Make your password complex and you help make it secure.  Random placements of letters, numbers, and symbols will make it very difficult for cybercriminals to hack into your accounts.
  • Do not use the same password: Using the same password for every login is a recipe for disaster:  A cybercriminal now only needs to crack one password for unlimited access to all of your online accounts.
  • Do use longer passwords: When it comes to password security, the longer the better.  According to online security experts, a password 15 characters in length could take up to two trillion years to crack.  However, password length isn’t everything:  You must be sure to utilize a mixture of letters, numbers and special characters.

By creating long, complex, and unique passwords for every one of your authentication accounts, you will guarantee password strength.

2. Change your password regularly

It is very important to create strong passwords, but even strong passwords can be discovered by expert cybercriminals – especially if they are given ample time for discovery.  That is why it is essential for you to get into the practice of routine and mandatory password changes.

A perfect time to schedule updates is with the change of seasons as they divide the business year into obvious and unforgettable quarters.  And, as it is now fall, it is the perfect time to begin this excellent practice.  You can start by announcing a mandatory password change in the next few weeks and update your business calendar for three more alterations for the winter, spring, and summer.

3. Keep written reminders secure or use a Password Manager

Long, complex, constantly changed passwords are hard to remember.  You may need to write them down as a practical safeguard.  Just be sure to avoid the bad habit of keeping these written reminders close to your computer – or even worse, taped to your screen for all to see.

If you need written reminders, keep them in a secure area away from your workspace, such as at home or in the glove compartment of your car.  Better yet, consider using a Password Manager to record and manage your passwords.  (See the July 2014 Bryley Tips and Information for a review on Password Managers.)

4. Keep reset information up-to-date

There will be moments when you simply cannot remember a password and will need to request a reset.  As a precaution you should always be certain that your online accounts have your relevant email address on file so that when reset information is sent, it is sent to you and not to an abandoned account that has the potential to be exploited.  It would be best to get into the practice of checking reset information on the scheduled dates for password changes.

5. Review your organization’s password policy

Take the time during your quarterly password changes and reset information checks to review and/or update your organization’s password policy, which has the rules and procedures employees are required to adhere to in order to ensure password and network security.  If your organization does not already have such a policy, be sure to create one and distribute it to all technology-enabled employees.

6. Expunge temporary usernames and passwords

If you recently employed any temporary staff or summer help, be sure that their usernames and passwords no longer access your system.

Recommended practices – Part-3: Password security

/in , , /by

This is a multi-part series on recommended practices for organizations and their end-users.  Additional parts will be included in upcoming newsletters.

October is National Cybersecurity Awareness Month, and to help you celebrate, we have compiled a list of best practices for password-strength optimization.

Passwords are the primary tool for online authentication; as such, they are targeted information for cybercriminals looking to gain access to your workstation, mobile device, and/or personal records.  Proactive measures are vital to prevent online identity theft, network infiltration, system crashes, and the spread of malware.  By following the practices described below you will fortify yourself against these malicious cyber threats.

1. Create a “strong” password:

A strong password is one that cannot be easily identified by a cybercriminal.  When creating your next password, here are the do’s and do not’s of password strength:

  • Do not draw from the obvious: When selecting a password, do not draw from obvious sources – your name, your child’s name, not even something as seemingly ambiguous as your favorite flavor of ice cream or a random word.  With social media, today’s cybercriminal can easily aggregate personal information and crack obvious passwords.  Even if you feel that your password is obscure and/or unconnected to yourself, if the password is simply a word or phrase, dictionary attacks – programs that plug in every word from a database – can still compromise you.
  • Do use a mixture of letters, numbers, and special characters: Make your password complex and you help make it secure.  Random placements of letters, numbers, and symbols will make it very difficult for cybercriminals to hack into your accounts.
  • Do not use the same password: Using the same password for every login is a recipe for disaster:  A cybercriminal now only needs to crack one password for unlimited access to all of your online accounts.
  • Do use longer passwords: When it comes to password security, the longer the better.  According to online security experts, a password 15 characters in length could take up to two trillion years to crack.  However, password length isn’t everything:  You must be sure to utilize a mixture of letters, numbers and special characters.

By creating long, complex, and unique passwords for every one of your authentication accounts, you will guarantee password strength.

2. Change your password regularly

It is very important to create strong passwords, but even strong passwords can be discovered by expert cybercriminals – especially if they are given ample time for discovery.  That is why it is essential for you to get into the practice of routine and mandatory password changes.

A perfect time to schedule updates is with the change of seasons as they divide the business year into obvious and unforgettable quarters.  And, as it is now fall, it is the perfect time to begin this excellent practice.  You can start by announcing a mandatory password change in the next few weeks and update your business calendar for three more alterations for the winter, spring, and summer.

3. Keep written reminders secure or use a Password Manager

Long, complex, constantly changed passwords are hard to remember.  You may need to write them down as a practical safeguard.  Just be sure to avoid the bad habit of keeping these written reminders close to your computer – or even worse, taped to your screen for all to see.

If you need written reminders, keep them in a secure area away from your workspace, such as at home or in the glove compartment of your car.  Better yet, consider using a Password Manager to record and manage your passwords.  (See the July 2014 Bryley Tips and Information for a review on Password Managers.)

4. Keep reset information up-to-date

There will be moments when you simply cannot remember a password and will need to request a reset.  As a precaution you should always be certain that your online accounts have your relevant email address on file so that when reset information is sent, it is sent to you and not to an abandoned account that has the potential to be exploited.  It would be best to get into the practice of checking reset information on the scheduled dates for password changes.

5. Review your organization’s password policy

Take the time during your quarterly password changes and reset information checks to review and/or update your organization’s password policy, which has the rules and procedures employees are required to adhere to in order to ensure password and network security.  If your organization does not already have such a policy, be sure to create one and distribute it to all technology-enabled employees.

6. Expunge temporary usernames and passwords

If you recently employed any temporary staff or summer help, be sure that their usernames and passwords no longer access your system.