Risks of Compromised Passwords_

Why are passwords important and what can it mean if a password is compromised?

Passwords help secure your private, personal or company information.  They are your first line of defense against unauthorized access to your confidential information.  Consider the other tools we use to verify our identify, such as social security number, drivers license or passports.  We keep these items secure.  In the same way, we should consider keeping safe all the information protected by the use of passwords.  

Passwords, passcodes, and PIN’s have endured as the most common methods of access control used for securing our valuable digital resources, such as:

• • • Computers and mobile devices
    • Banking websites
    • Social media accounts
    • Email accounts
    • E-commerce sites
    • Cloud storage
    • Utilities provider payment and monitoring portals

Passwords have historically been a primary layer of security, in some cases the only layer.  Unfortunately passwords are vulnerable to being:

• • • • Guessed by humans
      • Cracked by computer algorithms
      • Captured from where they are stored (securely or insecurely)
      • Shared with others

Reports of account breaches from the same study due to this common password mistake:

(source:    https://www.passwordmanager.com/passwordmanager-trust-survey/)

How can I know if my password has been compromised?

If you are concerned that your credentials have been compromised, you can do a quick check by visiting https://haveibeenpwned.com

If you find that your account is on this list, please change your password immediately.  Review the following guidelines for helpful tips on how to create a strong password.

So what are the guidelines that make up a weak vs a strong password?

How Can I Confirm that My Password is Strong Enough?

If you would like to assess your current password's strength rating or generate a stronger password, look to the resources below:

https://howsecuresmypassword.net (maintained by security.org)

https://passwordmonster.com (maintained by My1Login)

https://haveibeenpwned.co/Passwords (maintained by haveibeenpwned.com)

A passphrase is a type of password, but the simple distinction is that a passphrase employs multiple random words to efficiently create a very long password that is much easier for a human to read, understand, remember and type.  Simultaneously, it is much harder for a computer to guess or crack using any of the various, common methods used today.

(source: https://howsecureismypassword.net/)

*** The preceding examples should only be used simply as illustrations--don't use any of these example passwords/passphrases.  You can easily generate your own strong passwords using methods and resources mentioned throughout this article.***

Multi-Factor Authentication - The Next Step

In addition to using a strong password, most applications have the option to enable another layer of security called multi-factor authentication (MFA), also referred to as two-factor authentication (2FA).  This is an electronic authentication method in which a user is granted access to an application or website only after successfully providing an additional authorization.  This can be done via a phone call, push notification, text message or entering a code sent to a designated email or phone number.  There are also authentication applications that you can use for this purpose.  It is less likely that a hacker will also have access to your cell phone, for example, to be able to confirm your identity, so having this secondary security in place increases security for your valuable information.

Microsoft reports based on their research that MFA can prevent over 99.9% of account compromise attacks.  (source: https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/)

For more information on visit our Multi-Factor Authentication Blog

Password Managers

Even better than generating passwords according to security guidelines for yourself is to use a trusted password manager that has a strong password generator built-in to the service.  Read on for more information on what they do and why they are so valuable.

Primary Benefits of a Password Manager

• • • • • Centralizing the work of password management using a single tool
        • The ability to memorize one master password and use it to access many saved passwords
        • Access to a strong password generator/password strength assessment tool in the application
        • The ability to access the password manager service whether you are using a computer, mobile device, or via the web (for most password manager services)
        • A security-by-design approach that can be a part of an industry compliance strategy (HIPPA, PCI, etc.)
        • Ability to secure the service using Multi-Factor Authentication, as discussed previously

Browser password managers (Firefox, Chrome, etc.) are generally considered to be weak and relatively insecure solutions—it is not recommended to trust these with your secure data.  More secure and feature-filled password managers are available which offer good accessibility and ease-of-use, and can be integrated into your browser or accessed from your desktop or mobile device.

For more information visit our Password Managers Blog

This article has covered a lot of information.  To summarize, please review the following Best Practices for Password and Access Control.  Feel free to reach out if you have a question about anything listed in this article or if you feel your credentials have been compromised.  We are happy to connect you to one of our knowledgeable staff to assist with concerns or help you setup additional security.

The security guidance mentioned in this article takes in account the typical risk profile for most users regarding passwords. Following the best practices recommendations for passwords, MFA, and other security protocols will reduce risk of password breach for all common vectors and modalities of attack.

If you have questions about how we can help or would like to know more about the services we provide, please click the link to setup a call.