Poor password hygiene can create critical security risks. These unsafe practices make it easier for cybercriminals to crack or steal passwords using malicious software, tools, or social engineering to access employees' personal identifiable information, compromise websites and system data, and make organizations vulnerable to preventable cybersecurity breaches. Some of the most common poor practices include:
- Using weak or predictable passwords, such as “12345” or “password” or names of family members or pets.
- Using short passwords, or overemphasizing password complexity over length.
- Reusing passwords across multiple accounts, even if the password is strong enough.
- Storing passwords insecurely, such as on sticky notes, as plaintext files, or as unencrypted documents.
- Sharing login credentials with colleagues or family members.
- Not using password managers.
To maintain data security and protect the organization against cyberattacks, the following best practices can be put in place:
Make long passwords
Short passwords are easy for hackers to break using password-cracking software. Short passwords of six characters or less can be broken relatively easily; however, with each additional character the password becomes significantly more time-consuming, and therefore difficult, to crack. Passwords should be at least eight characters long as they are exponentially more difficult to crack than a six-character password.
Although password complexity (using upper case letters, numbers and special characters) is also desirable, according to the National Institute of Standards and Technology (NIST) it is not nearly as important as password length. A good password can be three random words or a phrase of appropriate length.
Use a Password Manager
Passwords are vulnerable when they are easy to guess or when they are made public after a data breach. Password managers mitigate both risks by generating and saving complex, random passwords unique to each of a user’s accounts. Complex passwords are difficult to guess, and if one is exposed in a data breach the damage is minimized because it is not shared among the user’s other accounts.
Password managers offer free and paid options. Standalone password managers (e.g., 1Password, LastPass, Bitwarden) are typically best due to their features and flexibility, but built-in browser or operating system password managers may also meet needs. Additional password manager features include the capability to store other sensitive information (credit card numbers, addresses, etc.) as well as options to share passwords without revealing them.
Enable Multi-Factor Authentication (MFA)
After they enter a password, MFA prompts users for another way to prove their identity, such as via mobile app notification, biometric scan, or text message (SMS) code. Even the best passwords aren’t immune to being cracked or exposed to a breach; MFA is a crucial layer of additional protection.
MFA availability varies, but many banking, shopping, social media, email, and other online services provide it. MFA can also be used to protect password managers for an additional layer of defense.
Related
Tags
Article
AI: Markers Along the Inflection Path
Security practitioners must balance AI-driven automation with human intelligence, ensure compliance with evolving AI regulations, and monitor geopolitical risks tied to AI adoption.
By Chris Hurst
March 20, 2025
Article
How to Strengthen Organizational Resilience During an IT Outage
A mass notification system enables organizations to achieve operational resilience, keeping employees informed and customers engaged even when primary communication systems fail.
By Ann Pickren
March 12, 2025
Intelligence Analysis
US Designation of Criminal Organizations as Terrorist Groups Poses Business Risks
On Feb. 20, the US government designated eight transnational criminal groups as foreign terrorist organizations.
By Michael Baney
March 11, 2025
Case Study
Mass Notification Supports Employee Safety and Business Continuity During Multiple Natural Disasters
Mass Notification helps large manufacturer ensure employee safety and business continuity during LA fires with fast, targeted communication.
March 4, 2025