Log-in credentials matter. As does the management of those credentials. Regardless of role, people are generally the first line of defense in cyber security and individuals are in charge when it comes to passwords. You work to adhere to the password rating system, and then there is the suggestion to change passwords every 90 days. An ardous task for many.
Enter pass phrases. A pass phrase, or a small group of words standing together, is far easier to remember and brings noteworthy security benefits. Length exponentially increases the effort it takes to crack a code. Calculate possible combinations for this phrase, “King Arthur Court was a court but it is no more.” That’s 3737 – a bigger challenge for hackers than a shorter password. When creating a pass phrase, length and unpredictability are key, as is rarity. Don’t use a favorite song or a favorite Hemingway quote. Pick something esoteric.
Along with a move to pass phrases, ensure you have different credentials across websites. If a hacker breaks into your Google account and reverses that password, it can potentially be used to log into many additional accounts that share that password Think: How many websites have your credentials stored? Take the case when you bought a random gift from a shopping site. You never went back to this site but the company failed to store your password as a cryptographic hash. Now your password is out and so it begins, the criminal art of credential stuffing2 or the automated injection of stolen username and password pairs into login forms to gain access to accounts.
To #BeCyberSmart:
Use pass phrases. Get a password manager.
A password manager will help you remember your log-in credentials while maintaining security. For sensitive accounts, e.g., banking, create a pass phrase. Allow the password manager to create randomly generated passwords for other accounts and do not change your credentials unless you are alerted to a breach.
Enable MFA.
Multi-factor authentication is a must. If it’s offered, utilize it and realize that not all MFA is equal. A text message to a phone is not as secure as a code generator. A security key is recommended for authenticating log-in to your password manager or bank. And while biometrics are convenient, you wear your biometric “code” in the open, every day. It is infinitely hackable and cannot be changed like a password.
Secure account recovery settings.
Look at your account recovery options across key accounts. When answering security questions, use a random pass phrase. For example, if your high school mascot is a recovery question do not enter “Bulldogs.” This information is easily accessible.
Making smarter decisions can help keep our interconnected world more secure.
1 Cost of a Data Breach Report 2022 | IBM
2 Credential stuffing | OWASP Foundation