Adding a number to 'welcome' doesn't make it a strong password

Problems at the top

Insecure passwords remain a problem for many organisations. As Rickey says in our podcast, "It's often at the top of the organisation that things go wrong. Maybe the CEO will think that remembering a strong password is a bit of a nuisance and opt for 'welcome01', 'welcome02' or 'welcome03', depending on how often he changes his password. And the technical staff will feel that they've got to make an exception for the boss. Hackers know that's the way things often work, so they start at the top when looking for a way in. And, more often than not, they find one. Another plus for hackers is that managers usually have more system permissions, so cracking an exec's password tends to mean hitting the jackpot."

Awareness

Use of weak passwords is a persistent problem. We all know that security makes sense, but somehow the threat tends to seem remote. "Often, the need to act only hits home when people are shown their own password," says Rickey. There are various online tools that tell you whether a password has been leaked. Examples include scatteredsecrets.com, Have I been Pwned and the tool made available by the Police. Or maybe you can spot your password in the following list of the hundred most frequently cracked Dutch passwords in 2019 and 2020.

Source: scatteredsecrets.com.

It's important that everyone recognises that a weak password puts the whole organisation at risk. The point therefore needs flagging up repeatedly and frequently. Ask people to check that their passwords aren't in the cracked list or known to the online tools. If so, there's a possibility that their passwords are known to cybercrooks. Anyone with a suspect password should be urged to swap it for a strong one as a matter of priority. The following tips will help them come up with something better.

Devising strong passwords

When setting a password, always go for something long and complex. A password like that is hard for a hacker or computer to work out.

• Never use obvious words or phrases, such as the names of loved ones, number sequences (1234) or logical keyboard character strings (qwerty). Things such as welcome1 or words that you can find in a dictionary are also easy to guess.

• Your password should have at least thirteen characters. The more characters, the more secure it'll be.

• It's a good idea to use a sentence, e.g. a saying or a song lyric. A sentence is longer and harder to crack than a single word.

• Combine the sentence with numbers and special characters, and include both lower-case letters and capitals.

• Where possible, use two-factor authentication: a set-up where, after entering a password, you have to verify your identity in order to access your account. Verification is usually on the basis of a code provided by or sent to a different device (e.g. your phone).

• Use a different password for each account. Then, if there's a security breach, the hackers will only get access to that one site or application.

Tip: use a password manager

Counting personal and work accounts, lots of people have thirty passwords. Unfortunately, though, most of us find it well-nigh impossible to remember that many long passwords. And writing them down or saving them on a phone or in a mailbox really isn't secure. So it makes sense to encourage your staff to use a password manager. Then they'll each have a 'digital safe' to lock up their passwords. Instead of needing to remember umpteen passwords they dreamt up ages ago, each staff member simply has to know the master password to their personal password manager. That master password does, of course, have to be super-strong. So it's a good idea to use two-factor authentication to control access to the password manager. When choosing a password manager, go for one that saves your passwords in encrypted form. Here are some (free) password managers to consider:

• LastPass

• Dashlane

• Password

• KeePass

• iCloud Keychain