The Art of Creating Strong Passwords
Posted by Rick at 9/17/2009 11:21 AM 
Categories: Security
Tags: Technology; Security; Password; Intrusion
Categories: Security
Tags: Technology; Security; Password; Intrusion
There was a great article posted that reinforces what my team has been preaching about password protection. I would like to continue with how important it is to create a password policy that is strong enough but also simple enough so that the password can be remembered. You may have the greatest policy ever but if an employee needs to write it down, I bet i can find it under a keyboard, or taped to the side of a monitor. Quite often I can log into machines because the passwords are either the default (usually for admin applications, and very scary) or they are located nearby! The article here by Michael Scalisi mentions a number of simple ways to create password policies and all i'd like to add is that words found in the dictionary and/or are under eight characters can be cracked by automated programs in under a second!
Please read the article below for specific examples:
Please read the article below for specific examples:
The Art of Creating Strong Passwords
By Michael Scalisi, PC World
When it comes to password strength, educating users is just as important as enforcing policies.
Left to their own devices, people will choose passwords that are simple for them to remember. They'll use their spouse's name, their dog's name, their favorite sports team or a recent vacation spot.
Sometimes while working on a user's computer, I'll need to log on as that person after a reboot. Unfortunately, he's wandered off, not wanting to hover over the IT guy. I generally prefer not to know other people's passwords, so I usually don't ask. In this situation, I sometimes take a guess. I've been right a surprising number of times, and sometimes with people who are very powerful. It's easy. I simply glance around their offices and note what their obsessions are.
Clearly, password policies are needed.
By using the following tips, people will be able to create easy-to-remember passwords that follow these typical requirements: at least eight characters long and with at least three of the following character types: uppercase letters, lowercase letters, numbers and special characters.
- Substitute numbers for letters and vice versa. (o instead of 0, 4 instead of A, 1 instead of L, E instead of 3)
- Substitute words for numbers (one, two, three ... )
- Combine both of the above (0ne, thr33, f1ve)
- Use capitalization in random places (bLue, happY)
- Use special characters ( !@#$%^&*(){}[] ) to punctuate and separate words
- Create passwords out of words, numbers or phrases you'll remember
- Misspell words
Using these tips, you can create memorable passwords that will be nearly impossible to guess. Here are some examples of converting memorable information into a complex password
We'll start with some easy ones:
- Friday becomes frYday!
- Robert becomes #robERt#
- 867-5309 becomes 8siX753o9
More complex passwords:
- 19 Peach Place becomes: 0ne9peacHpl!
- I love Jill becomes: eYelov3Jill
- My dog Fritz becomes MeyedogfrltZ
While some of these examples look nearly indecipherable, you can see how they're not difficult to memorize -- as long as you know the originating word, number or phrase and the basic methodology used to create it. By educating users on how to create strong passwords, you strengthen the security of your company, and your users will benefit additionally by have safer personal experiences with online banking and social networking.
Michael Scalisi is an IT manager based in Alameda, Calif.
Comments