Poor password hygiene can create critical security risks. These unsafe practices make it easier for cybercriminals to crack or steal passwords using malicious software, tools, or social engineering to access employees' personal identifiable information, compromise websites and system data, and make organizations vulnerable to preventable cybersecurity breaches. Some of the most common poor practices include:
- Using weak or predictable passwords, such as “12345” or “password” or names of family members or pets.
- Using short passwords, or overemphasizing password complexity over length.
- Reusing passwords across multiple accounts, even if the password is strong enough.
- Storing passwords insecurely, such as on sticky notes, as plaintext files, or as unencrypted documents.
- Sharing login credentials with colleagues or family members.
- Not using password managers.
To maintain data security and protect the organization against cyberattacks, the following best practices can be put in place:
Make long passwords
Short passwords are easy for hackers to break using password-cracking software. Short passwords of six characters or less can be broken relatively easily; however, with each additional character the password becomes significantly more time-consuming, and therefore difficult, to crack. Passwords should be at least eight characters long as they are exponentially more difficult to crack than a six-character password.
Although password complexity (using upper case letters, numbers and special characters) is also desirable, according to the National Institute of Standards and Technology (NIST) it is not nearly as important as password length. A good password can be three random words or a phrase of appropriate length.
Use a Password Manager
Passwords are vulnerable when they are easy to guess or when they are made public after a data breach. Password managers mitigate both risks by generating and saving complex, random passwords unique to each of a user’s accounts. Complex passwords are difficult to guess, and if one is exposed in a data breach the damage is minimized because it is not shared among the user’s other accounts.
Password managers offer free and paid options. Standalone password managers (e.g., 1Password, LastPass, Bitwarden) are typically best due to their features and flexibility, but built-in browser or operating system password managers may also meet needs. Additional password manager features include the capability to store other sensitive information (credit card numbers, addresses, etc.) as well as options to share passwords without revealing them.
Enable Multi-Factor Authentication (MFA)
After they enter a password, MFA prompts users for another way to prove their identity, such as via mobile app notification, biometric scan, or text message (SMS) code. Even the best passwords aren’t immune to being cracked or exposed to a breach; MFA is a crucial layer of additional protection.
MFA availability varies, but many banking, shopping, social media, email, and other online services provide it. MFA can also be used to protect password managers for an additional layer of defense.
Related
Tags
Case Study
Crisis24 Provides Emergency Assistance During Civil Unrest in Kenya
Several Clients, Including Students, Safely Evacuated...
January 9, 2025
Article
Saudi Arabia: Hosting of 2034 World Cup Reflects Commitment to Vision 2030 Reform Agenda
Saudi Arabia will host the 2034 World Cup, an initiative that represents the country’s efforts to become a global player in sports and entertainment.
January 8, 2025
Article
Cruise Line Enhances Duty of Care with Crisis24 Travel Risk Management
A leading cruise line operator sought to enhance its duty of care for global personnel, mitigate travel risks for employees, and strengthen overall bu...
January 8, 2025
Article
Europe and US: Recent Holiday Attacks Highlight Threat to Public Events and Soft Targets
Recent attacks over the holidays in Germany and the US highlight the growing threat radicalized attackers pose to high-profile events and soft targets.
By Brian Moser
January 3, 2025