Cybersecurity Awareness - Password Tips And How to Create a Passphrase

Computers and smart devices all use accounts that store our information. Passwords are needed to keep our accounts secure but do you protect your passwords? With all we put online or store on our devices, do you practice good password management?

The month of October has been designated as Cybersecurity Awareness month so I assembled a few item pertaining to managing your passwords.

Here are tips on making a strong password, using a password manager, and when you should change your password.

IMPORTANT !!

There is no single thing that protects your information online. Security should always be thought of as a layered approach.

Combine strong passwords with biometrics (eg finger print reader) and/or Two Factor Authentication (2FA), coupled with safe browsing habits where you exercise caution as you visit various websites.

No Systems Is Safe (that includes Apple devices)

Realize that online accounts and accounts that give access to a device you use frequently where you send and receive information contain key pieces of information about us or the organization we work.

Information typed on a keyboard and transmitted from any computing device (to include smartphones) is potentially something that can be intercepted by a third party.

Hackers use these pieces of information for a variety of reasons. None of the reasons are good.

Passwords - Your first line of defense

Create a strong password. A “strong password” means it cannot be guessed by a cyber criminal and then used to access your account. Stolen passwords can be used to access a network where you work, a bank you do business, a credit card company, or an online retailer. Once they have access via your account, they can then use computers resources or steal data.

The general rule is that it should be EASY for you to remember but DIFFICULT for cyber criminals.

What is a bad password?

Don’t ever use the word password as your password. But also don’t use a name that would be associated with you as it can be easy to guess.

Avoid a simple word or name with just a symbol or number.

BAD EXAMPLE: mrfred99

I recommend avoiding these and variations of these password examples because they are can easily be cracked by a software program used by hackers.

What is a better password?

Passwords combing multiple random words and a passphrase are more secure. The random words should be unrelated to you and each other. Creating a passphrase is relatively easy.

TIP Online accounts do get hacked. Unfortunately, we do get lazy with our passwords. When creating a passphrase, consider using an 2 or 3 characters that you know and would give you an idea which account was hacked. This way if you are contacted telling you your password has been hacked, you can then immediately go to that account and change it.

Should I use a password manager?

A password manager is a software program that securely stores your passwords. Some password managers also generate strong, unique passwords to use with your numerous accounts.

Good password managers keep these passwords securely on your pc and allow you to create encrypted backups. Backups should be stored on an external drive and stored in a location that is safe.

When selecting a safe place to store a backup stored on a USB drive or similiar, realize it should be safe from fire or floods. Fireboxes are a good idea however, ensure they are rated to sustain heat that won’t damage the storage device.

Example password managers are SplashID and Last Pass. When looking into password managers look to see if you have to connect online and if you do, how secure the connection to their online storage is. Look for explanations on how they encrypt their information when you create it on your computer, transmit it to their online site, and then store it on their site.

What is Two-factor authentication?

Using multi-factor authentication means that you can only access your account when you successfully provide two more pieces of information (or factors).

Two-factor authentication or (2FA) usually combines a password and a prompt for additional information sometime via a third party that provides the info.

For example, I enabled 2FA on several online accounts. Whenever I attempt to login with my password, I am then prompted to provide a additional code that is either sent to me via email/text or generated by an app on my smartphone.

A list of 2FA providers can be found here.

A Tip: When should I change my password?

The advice I give to my students about when to change their passwords is simple.

In the United States, we change our clocks in the spring and the fall. When we do change our clocks we have also been guided to change the batteries in our home smoke detectors.

I would also add this. Why not change your passwords at this time too? At a minimum change the password to your password vault or file where you store all your passwords.

If you do not live in the United States, connect the event to another event you recognize on frequent basis so you can remember to do this.

If you follow this approach, you are now changing your passwords at least every 6 months and this adds another layer to your security plan making it harder for someone to hack your account.

Good luck with updating your passwords!!!