Six best practices for password security
Everyday cybersecurity efforts often come down to something much simpler: passwords. Insecure or inadequate passwords are an easy target for cybercriminals. Accessing a network using a stolen password is much easier than trying to break in through edge security protocols.
The goal is to promote better cybersecurity hygiene by upgrading easy-to-guess passwords or refreshing older passwords that may have been compromised through some data breach. Think of it as the cyber equivalent of testing and replacing the batteries in your home smoke detector.
Being diligent about creating strong passwords and updating them regularly is the first line of defence in securing both your personal and corporate information. Maintaining strong passwords and having a password strategy you can easily manage—but that others cannot easily guess—is an essential cybersecurity effort that every employee and individual plays a crucial part in.
Weak Passwords Create Security Risks
According to the Verizon Data Breach Investigations Report,81 per cent of breaches leveraged either stolen and/or weak passwords. That problem is compounded because one of the biggest risks to data security is the reuse of passwords across accounts. If one of your accounts is compromised and your user name and password are posted on the dark web, cybercriminals who know how often passwords are reused will simply begin to plug that information into other possible accounts until they unlock one that uses the exact same credentials.
This is a common risk, as 83 per cent of people has admitted to reusing passwords across multiple sites. Even if you think, it is safe to reuse passwords on accounts that don’t house sensitive data – a breach there can be used as an entryway to move laterally across networks in search of critical business data or personally identifiable information (PII).
What Constitutes a Weak Password?
Short, simple passwords take fewer resources for hackers to compromise. In fact, hackers maintain databases of the most common words, phrases, and number combinations that they can run your password through to find a quick match.
Some of the most common passwords are baseball and football team names, any variant of 123456789, and QWERTY. Avoid using common password themes when creating a passphrase, such as the following:
- Phone numbers
- Names including movies and sports teams
- Simple obfuscation of a common word (“P@$$w0rd”)
Cyber adversaries are constantly tweaking their tradecraft to ensure successful intrusions in order to generate consistent revenue and profit. If your password is guessed or stolen or guessed, you may never know it happened until anomalous purchases appear in your bank account. And even more challenging, you may not be impacted directly at all. Data accessed by leveraging your compromised account may simply be used to move up the food chain, enabling an attacker to gain access to data and resources managed by someone else.
6 Best Practices for Creating Secure Passwords
Passwords are like toothbrushes—you want to choose a good one, never share it, and replace it quarterly. The best password is a strong passphrase, impossible to forget and difficult to guess, even for someone who knows personal details of your life like the name of the street you lived on as a child. The worst kind of password is one that everyone uses, is easily guessed, or uses common phrases and words.
When creating new accounts or updating well-used passwords, keep these six best practices in mind to minimize password-based cyber risk.
- To add an extra layer of security, use multi-factor authentication wherever possible. This confirms your identity by utilizing a combination of multiple different factors, such as something you know or something they have, such as a token generator on your smartphone.
- Never repeat the same password for different accounts.
- Change your passphrase at least every three months. This will lock out cybercriminals who may be using your account, protect you from brute force attacks, and remedy the issue caused by cybercriminals who purchase lists of usernames and passwords obtained through data breaches.
- Ensure no one is watching as you enter passwords.
- Be cautious when downloading files from the internet as they may contain key loggers as well as password grabber malware variants that will compromise your password. A good practice is to regularly scan for the presence of such malware.
- Use a cloud-based password manager to enable you to create and store strong passphrases. This is especially important if you require strong passwords for dozens of accounts. Password management tools allow you to securely store an encrypted list of passwords in the cloud that can be accessed from any device.
When it comes to password security, everyone has a role to play in the protection of personal and corporate data. IT teams should review the common risks of weak passwords in their organizations, as well as remind everyone of these best practices. This simple practice can help employees better protect their data while minimizing unintentional insider threats to the organization.
This article was contributed by Fortinet.