I thought it was time we touched on this topic. It is something that we all are familiar with and almost everyone can tell you the value of having a good password, but it is also the weakest point in the security chain. We use a password on our accounts to protect the information which we are storing, yet it is seldom, if ever, changed or updated and generally it is easily guessed by a determined person. We also find that we may have multiple different accounts where we need a password in our day to day working life (let alone the multitude of personal password requirements for our net banking, personal email, etc.).
So, let’s list out the issues we find with passwords in our workplace :-
They are easy to forget, so we use simple things such as birthdays, pets, etc. so we can remember them.
There is no real incentive to change them, even if we have “loaned” them out to other people to help them at some time.
It is difficult to remember one password and far more difficult to remember several for the different logons which we may have, so we tend to use the same password wherever we can.
Now, let’s examine some drivers for having “better” passwords.
If they are more complex, then they are more secure. Even adding a single extra letter or digit can increase the security 10 fold or more.
If we use a different password for each account, the possibility of a cascading disaster after one being discovered is pretty much eliminated.
Finally, we can examine some factors which make a password stronger.
It is not contained in a dictionary. IE it is not a “real” word.
It is at least seven or eight characters long.
It contains Upper and lower case letters.
It contains a mix of numbers, punctuations (such as dash, comma, full stop) and some ‘special’ characters (such as !,*,&, or +).
It is reasonable to conclude that there is a need to have strong passwords and we would probably do so if it was reasonably simple to do and to remember. What are some techniques which we can use to keep it simple enough to remember, but complex enough to make it difficult to guess ?
Example 1 – modified “real” words
This technique can be made easy by following a pattern of changing letters in a word you know and will remember. We need two things – a word with 7 or more letters and a pattern.
As an example we will start with a word such as “discussion”.
Next, we select a pattern. We will make the last letter a Capital and replace the vowels (i , u and o) with a plus sign.
Following this technique, our password would be “d+sc+ss++N”. Not 100% perfect, but it is easy to remember, hard to guess and has some complexity.
Example 2 – words and numbers
The object here is to mix up words and numbers to create a password which is easy to remember as you know both parts of it, but difficult to guess as you have mixed it up.
In this example we will use your year of birth and subtract 1 just to make it difficult. For me it will be 1950 minus 1 = 1949. Next we will use a memorable pet’s name – mine is “Snoopy”.
Now I can create a great password “snoo1949pY”. I have used the two elements as discussed above, place the number in the middle of the word and, just for something special, I have put a capital at the end. That will be impossible for anyone to guess.
Example 3 – Use the ‘Shift Key’
The shift key is used for making CAPital letters, but also for using the special characters above the numbers at the top of the keyboard. We can have some fun with these too.
For our password elements we will use a non-word such as “uiop” (the last 4 letters on the top row of the keyboard – no need to remember them, jus remember where they are) and we will use a year which is familiar to us (I’ll select 1950 again), but when we enter it, we will hold down the shift key.
Our password will now be “uiop!(%)” - try it ! A really tough password to crack.
Summary
Don’t stress in creating passwords, just use things you know and mix them up a bit. It is really easy and can be fun experimenting.
Here are a few Golden Rules :-
If you have to give out your password, change it as soon as you can
Use different passwords for different accounts
Change them once in a while, every 6 months as a minimum
Don’t get too complex, but try for 7 or more characters.
