Sunday, March 20, 2016

Pesky Passwords

Since this blog is in support of my MS in Cybersecurity program, I thought the perfect way to start it off would be to talk about something each of us have, but might neglect: passwords.

If you're reading this, chances are you have an account with a password that you created...hopefully none of these look familiar:

- 123456
- password
- 12345678
- qwerty
- 12345
- 123456789
- football
- 1234
- 1234567

These are the 10 most popular passwords in 2015. If you are using any one of these (or the other 15 of the top 25), pay special attention to the next three words: CHANGE YOUR PASSWORD!

Creating a password that is easy to remember and also complex enough to avoid being cracked is easier than you think. We need to establish some guidelines before we get started:

1. Length - your password should be at least 8 characters, but I recommend 12 or more
2. Character variance - use a mix of upper and lower case letters, numbers, and special characters
3. Avoid keyboard walks - this is a password that looks like this: qwertyuiop OR 1qw23er45ty6
4. Avoid dictionary words - at least avoid them as they appear in the dictionary

All set? Let's get started! One easy method is to pull a quote or lyric from your favorite movie or song...because I'm a nerd, let's use Star Wars - May the Force be with you.

Right away, we have 20 characters, excluding the spaces, which looks like this - MaytheForcebewithyou

We already have a couple different upper and lower case letters, so let's add some numbers and special characters. Since we will be swapping out some of our letters, we need to look at other characters that look like them. Here are a few that look similar:
I = 1
i = !
s = 5
E = 3
B = %
b = & (okay, the 'B's' might be a stretch but they work, right?)

Alright, time for the numbers!
MaytheForcebewithyou turns into Mayth3Forc3b3withy0u

Let's add some crazy special characters!
Mayth3Forc3b3withy0u turns into M@yth3Forc3&3w!thy0u

Right now, it's pretty good. But we're breaking the 4th guideline. One more change.
M@yth3Forc3&3w!thy0u turns into M@yth3Forc3&3w!t#y0u

The last change probably isn't necessary, since it would take a desktop computer 425 quintillion years to crack either way. But, you get the idea.

In addition to creating a good password, don't use the same password for everything.  Use a variety of passwords for your accounts.  In the event your password is compromised, the same key will open all doors.

One final thought.  You should change your password periodically.  Every 90 days is a good baseline, just make sure you create something hard to guess each time.

No comments:

Post a Comment