Cybershots - Password Security
One of the biggest mistakes that users make is replicating the same or very similar passwords on multiple accounts. As a result, cracking one password will lead to a domino effect that allows hackers entry into multiple accounts with little effort. All of your accounts should use different strong passwords. Also, they use words such as their first names and last names which should be avoided. It should use a combination of special characters and words that will be difficult to guess.
Be careful not to use predictable passwords and avoid the most common ones eg. Password123
Studies have shown that frequent password changes actually lead to weaker credentials. Users are more likely to create short, easy-to-guess passwords because they’re forced to create and remember a new password every couple of months.
It’s become clear that people, if unchecked, follow very common patterns in password selection. As a result, cybercriminals use lists of common passwords and patterns found in previous breaches to narrow the universe of passwords attempted in their attacks.
Screening your passwords against a comprehensive set of unsafe/commonly used passwords gives rise to a unique set which makes it more difficult for cybercriminals to attack.
How to create better passwords?
The National Institute of Standards and Technology (NIST) recently published updates to their digital identity guidelines that advised companies to:
Avoid periodic password changes
Studies have shown that frequent password changes actually lead to weaker credentials. Users are more likely to create short, easy-to-guess passwords because they’re forced to create and remember a new password every couple of months.
Screen new passwords against lists of commonly used passwords
Companies just have to look at the most used passwords to see that users are still settling for convenience over security. To make things even worse many of these passwords have been compromised in previous breaches. Screening these passwords means that you can avoid using very weak passwords.
Remove arbitrary password complexity requirements
Asking users to include at least one uppercase letter, number, and symbol results in passwords like “Fido123!” and “Jessica1234%” which are very predictable and easy to crack.
