Last updated at Tue, 25 Apr 2023 22:43:35 GMT

Throughout October, we're creating basic emails you send to the users in your company to help educate them on information security issues that could affect them in the workplace. Each email provides some information on the issue itself, and some easy steps on how to protect themselves. Check out the first two posts, providing primers on phishing and mobile security.

This week, we're tackling passwords.  Many view passwords as a sub-optimal means of securing information in a day and age where we do everything from banking to dating online, and need to protect hundreds of different applications and services using strings of symbols that we need to remember. It isn't just our personal lives that are highly connected; many people in your organization likely have more than 5 passwords just to protect services accessed for work. I guarantee that some of them are reusing passwords across different applications, writing them down, and even sharing them with each other.

Unfortunately, passwords are a part of our reality, and quite possibly the best option when it comes to providing a manageable, enforceable control for all users. As we've recently seen with Apple Touch ID, biometrics aren't necessarily a better option. Tokens get lost or stolen and aren't practical for the majority of services. And at least passwords offer some basic legal protections.

So we're stuck with passwords for the time being, and your users need to understand why they're important and how to use them to best effect. Here's your email primer…

Why are passwords important?

Having a password is the most basic level of protection you can have for the information you are storing in services or applications, be it your personal Facebook account, your online banking site, or your company's customer tracking system.  The problem is that everything is online now, and everything needs a password. So it's tempting to make your password simple and easy to remember. Perhaps you have a go-to password that you've used for everything since college.  Or maybe you write your password down so you don't forget it.

If you do any of those things, you're probably in the majority, not the minority.  Creating long, complex passwords that are unique for every service you use is a challenge, and remembering them all is near impossible.  The problem is that simple, easy to remember passwords are also easy to “crack”. That's probably why a major study found that 76% of network intrusions (aka breaches) in 2012 involved weak or stolen passwords.

Once attackers have your password, they have access to your account and any information stored in it. From there, they may be able to do all sorts of things, and what was intended as a form of protection could become a threat in itself. For example, if you use the same password across multiple sites, once an attacker has compromised your information on an unimportant one, they can turn around and use it on a site you do care about. Or say you use different passwords, but the same security questions. They could find the information for your security questions and then set up a fake “change password” request using your information and actually lock you out of an important account.

Bottom line: passwords are an important security measure for every aspect of your life, including work.

How can you protect yourself?

There are a number of things you can do to reduce your risk and increase the protection offered by passwords.

  • Make passwords long and complex. Try to make your password more than 12 characters long and use at least one lower case character, one upper case character, one number, and one special character.  Shamefully, not all sites have enabled this yet, so it may not always be possible, but do it where you can.  Try stringing unconnected words together and mixing up the letters, numbers and special characters to make them extra hard to guess.
  • Don't reuse passwords. It is very difficult to remember unique passwords across everything.  You can tackle this by using a service like KeePass and LastPass, which securely stores your passwords.  All you need to remember is the password for your KeePass account! If you do reuse passwords across sites, be vigilant for any suspicious activity and at the first sign of trouble, change the password on any other sites where it was used.
  • Regularly change your password. Passwords should be changed every 8-12 weeks. Yes it's a hassle, but if an attacker has gained access without you knowing, it stops them from being able to keep coming back over and over again.
  • Two-factor authentication. Where possible, favor services that offer two-factor authentication and enable it.  The way this typically works is that it combines something you know (your password) with something you have (e.g. a generated code sent to your phone) to provide a double layer of protection.
  • Never use a default password. Many devices and applications come with default passwords set up.  You need to change these as soon as possible during your set up process. Using a default password is the same as using no password at all.