Password Security: What are the Best Practices for Password Security

My InfoTech Journal:
Password Security

This article is just a reminder on the importance of Password Security.

As we become more and more comfortable with using online services like banking, cloud drives for data repository, and other online services, we tend to be more relax and sometimes put our defences down. In most cases, we put our trust on the Service Provider’s security controls.

We oftentimes forget or tend to ignore the fact that these service providers are usual targets by cybercriminals and may one day fall victim to data breach and data leaks. Data leaks may include your account, password, and other personal information.

We might not have control over the service provider’s security controls, but as End-Users we should at least take precautionary measures for the things we can control, most fundamental is to ensure a strong password for our accounts.

Best Practices for Password Security

These are some best practices that can be useful to you. This article can also be a handy reference for keep your password secured.

These best practices aims to provide some guidance on what you can do to put some fundamental security controls on your passwords.

Use long passwords.

Best practice is to have 12 to 15 characters for your password.

Use complex passwords.

Complex passwords should be a combination of the following:
Letters (you can use upper and lower cases)
Numbers
Special Characters: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~"

Use easy to remember phrases.

You can be creative with your password phrases.
Example: The quick brown fox jumped over five lazy dogs
Password: TqBfJ05L@zyD0g$

Passwords should not include personal information.

Personal information like, birthday, anniversary, address, phone numbers, your name or family member’s name, and other personally identifiable data.
Some of these information may be in the forms you filled out on social media and possibly may already be available in public view.
Hackers can easily access these information.

Passwords should be unique and not shared (not the same) in any other accounts.

If a Hacker cracked your password, then the same can be used to access your other accounts from the different service providers.
A Hacker can use the same login credentials to login to your bank online services, do fund transfers, and other online services.
Another scenario is to hack into your social media account and use your profile to solicit money from your trusting friends.

Passwords should not be shared with anyone.

Sharing passwords with anyone exposes you to the risk of that person using your account to access your financial services portals and do transactions on your behalf.
Similar scenarios apply as if your account has been hacked.

Change passwords on a regular basis.

You may already be familiar with your office account that requires you to change password on a regular schedule, so you are reminded to change passwords every so often.
For those other accounts that don’t force you to change password, a good practice is to schedule this on your personal calendar so you can be reminded to change password every so often (quarterly or more frequent depends on the risk factors involved).
For financial online services, the best practice is to change password every month or two.

Do not write down your passwords on sticky notes

Do not write down your passwords on sticky notes and post them under your keyboard or anywhere.
Dumpster-diving is a common source of information for cybercriminals.
Cybercriminals will do anything necessary to get into your systems.
They will try to get valuable information from anywhere.
Cybercriminals rummaging through garbage bins might one day find your sticky notes with your account and password and use this to access your systems.

Never use your account and password in somebody else’s computer.

Account and password may be stored on somebody else’s computer without your knowledge.
Web browsers nowadays prompts to store passwords as a default option when it detects an account and password forms. Unknowingly or as a force of habit. you might save the information on somebody else’s desktop profile.
I would also recommend to refrain from using your account and password in public computers like those available in coffee shops, business centres, airport computer kiosks, and similar settings. You will not know who else have used these computers and without you knowing, there may be a malware installed to gather personal information including your account and password.
Some computers may have key loggers that can store keystrokes including your account and passwords.

Precautions when using public wifi.

Do not access web sites or portals that require account and password when using your personal device on a public wifi.
There might be hackers with sniffing tools waiting for you to commit a mistake.
If you really need to access a site using your account and password from a public wifi, you can do so and still be secured by using a VPN tool (Virtual Private Network) to protect your session.

Use of Two-Factor Authentication (2FA)

Two-Factor Authenticate refers to another layer of authentication on top of your existing password, which requires combination with any of the following:
Something you know: your password or your PIN

Something you have: your ATM, your credit card, your security token, your mobile phone, or your email.

Something you are: using biometric authentication like your fingerprint, your voice, or your face.

Two-Factor Authentication can also be compromised

Please take note and I have to say this over again, that cybercriminals will not stop until they got what they want.
Even if you have two-factor authentication, the second layer security can also be compromised.
You have to also understand what to do in case any of your two-factor authentication may have been compromised.
If you lost your ATM, then you must report this immediately to your bank. Have your card revoked and replaced with a new one.
If your phone is lost, immediately report to your local telco provider and request for SIM card replacement. Change all passwords that are stored each application in your mobile phone and initiate to log off from all devices.
Review immediately any request for password change sent to your email address. Reject if you have not made any changes in your account.

Disclaimer

This article is a result of my personal research and is not a substitute for legal advise.

Please consult your Legal Team, Ethics & Compliance, or Regulatory Team for the interpretation of specific CyberSecurity requirements.

My InfoTech Journal

Search This Blog