![\"How](\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/11\/Cybersecurity-Better-MOD-.jpg\")
<\/p>\n<\/p>\n
How can you and your business make the best password for each and every account? We gathered best practices information from cybersecurity experts.\u00a0\u00a0<\/strong><\/em><\/p>\n World Password Day has come and gone, and yet enterprises continue to struggle with creating strong passwords that hackers can’t immediately crack or guess. While other authentication<\/a> options and factors are starting to see more prominence, passwords remain the number one method by which accounts are accessed.<\/p>\n So you, and all of your employees, need to know how to make the best password. Here’s some advice (and even some arguments about why you should get rid of passwords entirely) from top cybersecurity<\/a> experts on what to do.<\/p>\n Jenn Markey is Director of Identity at <\/span><\/i>Entrust<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cOur collective hope as an industry is that one day World Password Day will be obsolete as encryption and advanced authentication replace the age-old practice of entering password credentials to access desired information. But until that day comes, organizations must continue ramping up their security tech and training to fill existing knowledge gaps and avoid detrimental breaches.<\/span><\/p>\n Requiring a password plus one or more added credentials, also known as multi-factor authentication (MFA), is a good way to prevent unauthorized account access, but going passwordless is so much better. Virtually every data breach can be traced back to compromised passwords, with phishing being one of the most common attacks. Working from home multiplies this risk with insecure workspaces and an increased propensity for bad habits like writing passwords down.<\/span><\/p>\n Instead of passwords, business leaders should work with their security and IT managers to implement and deploy high-assurance credential-based passwordless authentication that merges the power of digital certificates with smartphone biometrics to create an employee\u2019s trusted workplace identity, wherever that workplace may be. By eliminating the password, you effectively protect your organization from phishing attacks which minimize the risk of a data breach.\u201d<\/span><\/p>\n Dave Wagner is CEO of <\/span><\/i>Zix<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cWorld Password Day is an excellent time for individuals and businesses to reflect on their current password practices and ensure they are building the safest habits to protect themselves and their company from cyber-criminals. Many are under the assumption that if they are taking the steps to create unique passwords for each platform and application, they are secure. But it’s not enough.<\/span><\/p>\n The number of headline-grabbing breaches that have taken place over the last year highlight the critical need for safeguards across the entire company network. While there are a few different ways to protect login credentials beyond a simple username and password, one of the most popular and effective options is two-factor authentication (2FA). Implementing 2FA provides an extra layer of security by making users confirm their identity, most often via a unique code sent to the user’s phone, email address, or through an authenticator app, after entering their username and password. It\u2019s getting easier for cyber-criminals to breach even the most complex password, which is why implementing 2FA is critical.<\/span><\/p>\n Email is a common point of attack because it often contains sensitive and valuable communications. Organizations should also consider implementing an email security solution that conducts a security audit to analyze its admins, users, mailboxes, and rules for vulnerabilities such as outdated passwords so they can be resolved before a breach happens. Organizations should use World Password Day to evaluate their internal Password Policies and send reminders to employees and customers alike about the importance of good password hygiene.\u201d<\/span><\/p>\n Russell P. Reeder is CEO of <\/span><\/i>Infrascale<\/span><\/i><\/a>.<\/span><\/i><\/p>\n 1. Be Unpredictable\u00a0<\/span><\/p>\n There are two common password attacks – Brute Force and Dictionary attacks. Both generally involve a bot, but can also be done manually, and involve trying a sequence of numbers and\/or common words like 123456 – hence trying to crack a password using \u201cbrute force\u201d or common \u201cdictionary\u201d words. To minimize this type of exposure, don’t make your passwords predictable.\u00a0<\/span><\/p>\n 2. Be Creative\u00a0<\/span><\/p>\n Related to being unpredictable, consider creating a phrase and use the first or second letter of each word, or substitute a special character for letters and\/or numbers. If you just don\u2019t seem to have a creative bone in your body, you can always use a password generator. These are guaranteed to spit out some creative, and secure, password options.\u00a0<\/span><\/p>\n 3. Be Long\u00a0<\/span><\/p>\n These days when you get asked to create a password, most have a minimum of 10-12 character length. The longer the password, the more possible combination and permutations of the password there are, and thereby the safer they generally are. However, don\u2019t forget tips 1 and 2, because long common words and sequences of numbers are still easier to crack!\u00a0<\/span><\/p>\n 4. Be Smart\u00a0<\/span><\/p>\n Believe it or not, one of the more common reasons passwords are compromised is because people share their credentials. Quite simply – never, ever share your password(s)! Also, be mindful of phishing – this is where you receive an email or text message asking for you to confirm your details or take some other action where you need to enter your personal credentials. These types of acts are becoming increasingly sophisticated and can look very legitimate, like an email from your bank. As a good rule of thumb, unless you make a request, don’t ever enter your credentials. Or, if you have any doubts, contact the organization requesting the information directly.\u00a0\u00a0<\/span><\/p>\n 5. Be Fresh\u00a0<\/span><\/p>\n Refresh your passwords regularly. While it may seem onerous, and even if you think you have finally come up with the most secure password ever, one of the best ways to protect your password is to change it up regularly. In addition, you should use different passwords for different logins \u2013 yes, a different password for every login. Having a unique password for all your accounts assures that if or when one is compromised the others remain protected. Pro tip: If you can’t remember all your passwords, consider using a secure password manager.\u00a0<\/span><\/p>\n Elena Elkina (she\/her) is a Partner at <\/span><\/i>Aleada<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n \u201cAs the LinkedIn breach continues to showcase, many still use PASSWORD as a password. Single-word credentials are no longer safe. Instead, if you must remember your credentials, use passphrases. The danger with this method is that there is still a potential for re-use. The true recommendation is to use an auto-generated password from a password manager. And of course, any set of credentials should be placed behind MFA. We are still some time away from true passwordless authentication, however many players in the authentication space are taking this challenge on full force.\u201d<\/span><\/p>\n Saryu Nayyar (she\/her) is CEO of <\/span>Gurucul<\/span><\/a>.<\/span><\/p>\n \u201cPasswords are the bane of the security team’s existence. Users use weak passwords, reuse the same passwords, refuse to change passwords, or simply forget them and need help resetting passwords. I thought self-service password reset options would have alleviated the help desk from resetting user passwords. However, it still turns out 20% to 50% of all IT help desk tickets are still for password resets (according to The Gartner Group).<\/span><\/p>\n \u201cWe actually have the technology to eliminate passwords altogether, but that would require companies to indulge in passwordless authentication. MFA helps, but users really need to use better passwords. To be effective, passwords must be complex and over 16 characters in length. That’s why passwords fail because people can’t remember 17-character passwords – that are unique for every system. Instead, users should use passphrases they can remember and then append or prepend numbers and characters to make these passphrases complex. “Every good boy does fine +123” works. Pick your favorite song lyric and year. Associate your passphrase with the target system to make it easier to remember. Whatever you do, don’t share your passwords and don’t reuse them. Once a cyber-criminal gains access to one of your target systems by cracking your password, all your other systems are at risk.\u201d<\/span><\/p>\n Mathew Newfield is Chief Infrastructure and Security Officer at <\/span><\/i>Unisys<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n \u201c<\/span>Tip # 1:<\/b> Create your private passphrase rather than using a single word. This is a short statement that has meaning to you but is no longer than three or four words. An example of this would be: <\/span>Puppies are cute<\/span><\/i>. This will be your private passphrase and <\/span>should not <\/b>be shared with anyone.<\/span><\/p>\n Tip # 2: <\/b>Create a password key. This is your decoder! This key can be printed out and stored in your wallet or purse or even kept on your desk in plain sight. Without your private passphrase, it is useless.<\/span><\/p>\n Here\u2019s an example password key:<\/span><\/p>\n With your password key you will be able to transform your passphrase \u2013 e.g., <\/span>Puppies are cute <\/span><\/i>\u2013 into a complex password as demonstrated below.<\/span><\/p>\n Step 1: Use first \/ last letters of each word in your passphrase. <\/span>PSAECE<\/b><\/p>\n Step 2: Substitute A = @ <\/span>PS@ECE<\/b><\/p>\n Step 3: Substitute E = 3<\/span> PS@3C3<\/b><\/p>\n Step 4:<\/span> Add 2 Uppercase letters for authentication type (e.g., NW = network, etc) <\/span>PS@3C3NW<\/b><\/p>\n Step 5: Add 2 Lowercase letters for season (e.g., wr = Winter, sg = Spring, etc.). <\/span>PS@3C3NWsg<\/b><\/p>\n Step 6:<\/span> Add last 2-digits of current year. <\/span>PS@3C3NWsg21<\/b><\/p>\n Bonus Tip: Periodic password changes are recommended; using this method one can simply change the season and year to maintain password complexity.\u201d<\/span><\/p>\n Tom \u201cTJ\u201d Jermoluk is CEO of <\/span>Beyond Identity<\/span><\/a>.<\/span><\/em><\/p>\n \u201cWhen World Password Day was established in 2013, the world recognized that passwords were a necessary evil, despite being a flawed and insecure method of authentication. But the root of the problem goes back to the foundation of the \u2018commercial internet\u2019 in the mid-1990s, when Netscape and others enabled widespread access and consumer accounts, prompting a massive need and meteoric rise in password use, and beginning an era of consumer insecurity and exposure.<\/span><\/p>\n Fast forward to today and the problem has ballooned. Verizon\u2019s 2020 Data Breach Investigations Report (DBIR) revealed that 80 percent of breaches use stolen credentials, collected either through database leaks or phishing attacks. And even if you follow recommendations for password hygiene, criminals can still get their hands on your password through a range of means \u2013 from fraudulent \u2018phishing\u2019 sites to insecure password databases and even commandeering your phone to intercept password reset messages.<\/span><\/p>\n The industry has responded by putting an even greater burden \u2013 not to mention blame \u2013 on consumers, to compensate for what can only be described as a complete systemic failure and an unwillingness to upset the market apple cart by refusing to fix the foundational issue. Complexity and user frustration are ever-increasing with forced password resets, cumbersome password creation requirements, and extra steps for multi-factor authentication (MFA). In summary, consumers must expect and demand better of their internet security and end the \u2018stupid user\u2019 blame game. The industry itself is headed in this direction with corporations and groups advocating for the eradication of passwords \u2013 but the industry is not moving fast enough, and the technology exists to make change now.\u201d<\/span><\/p>\n Tim Bandos is CISO at <\/span>Digital Guardian.<\/span><\/a>\u00a0<\/span><\/em><\/p>\n \u201cWhile a lot of the coverage about passwords focuses on business users, it\u2019s really important not to overlook children and teens in this discussion. They will typically make some of the same types of common mistakes as adults when creating and using online passwords, but there are several that stand out the most for this age group.<\/span><\/p>\n One of the worst is sharing credentials with friends, boyfriends\/girlfriends, etc. At that age, relationships tend to be shorter in duration and some kids end up using the shared access against each other such as posting inappropriate messages on social media accounts or conducting surveillance over account activity. This type of password-sharing behavior may even stem from early childhood when parents would share their credentials with their kids for accessing devices or online sites. This should be avoided at all costs.<\/span><\/p>\n Secondly, kids and teens are exposed to devices everywhere they go from the library, to school, to over a friend\u2019s house, etc. It\u2019s important to avoid entering your credentials on untrusted devices that you do not own, control, or completely trust. Devices in public places should only be used for anonymous web browsing and not for logging into any of your online accounts since passwords can be easily stolen from these types of computers.<\/span><\/p>\n Finally, it\u2019s important to avoid using personal information when creating any of your passwords. Young kids, and even adults for that matter, want to generate a password that is easy enough to remember. So they\u2019ll use their name, birthdate, address, phone number, etc. These are all details that can be either easily guessed or end up further exposing you if a website is ever compromised.\u201d<\/span><\/p>\n Dr. Mohamed Lazzouni is CTO of <\/span>Aware<\/span><\/a>.<\/span><\/em><\/p>\n \u201c2020 saw a huge spike in cyber-crime following the COVID-19 pandemic, and as 2021 progresses the vulnerabilities continue to surge across all sectors. World Password Day was born to popularize some of the best practices in password protection, mainly the need to change passwords, use different ones for different applications, and choose complex compositions using letters, symbols, and numbers.\u00a0<\/span><\/p>\n However, the benefits of varied, long, and complex passwords add to the burden and the anxiety of the user. Luckily, many technologies have progressed significantly to lower the friction without compromising on security. As an example, biometric authentication gained considerable adoption amongst users to simply use face or voice biometrics to unlock devices or sign in into accounts.<\/span><\/p>\n If users must continue to use passwords, they should ensure they are following password hygiene in order to remain resilient to attacks on their personal information \u2013 many of which are not difficult to implement.<\/span><\/p>\n Tim Sadler is CEO and Co-Founder of <\/span><\/i>Tessian<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cWorld Password Day is a great reminder to take inventory of our passwords, including where they are stored, whether you reuse them for multiple accounts, and their complexity. Tessian\u2019s recent report found that 77 percent of people reuse passwords, and 21 percent use predictable cues like their favorite football team, their pet\u2019s name, or birthdays when crafting passwords. The problem? These personal details are likely to be found on people\u2019s social media channels, making it easy for hackers to scan publicly available information to try to crack passwords or even answer the security questions.\u00a0<\/span><\/p>\n To prevent account takeover and business email compromise, CISOs and their teams should help educate employees about their social media footprint, cybersecurity best practices, and how to spot impersonation attacks. They should also reinforce the need for strong passwords that don\u2019t include names or names of pets, birth dates, location, or other information that\u2019s easy to find online. Even better, use a password manager like 1Password to randomly generate impossible-to-hack passwords. And while it can be tempting to reuse passwords that are easy to remember, never reuse or duplicate any passwords for personal or professional accounts. A bad actor could guess just one password and gain access to multiple accounts.\u201d<\/span><\/p>\n\t\t\t![\"IAM](\"https:\/\/solutionsreview.com\/identity-management\/files\/2021\/02\/Identity_Suggestion_Engine_Horiz_800.gif\" "\\"\\"")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\nHow to Make the Best Password (According to Cybersecurity Experts)<\/h2>\n
Jenn Markey<\/b><\/h3>\n
Dave Wagner<\/b><\/h3>\n
Russell P. Reeder<\/b><\/h3>\n
Elena Elkina<\/b><\/h3>\n
Saryu Nayyar<\/b><\/h3>\n
Mathew Newfield<\/b><\/h3>\n
\n
Tom \u201cTJ\u201d Jermoluk<\/b><\/h3>\n
Tim Bandos<\/b><\/h3>\n
Dr. Mohamed Lazzouni<\/b><\/h3>\n
\n
Tim Sadler<\/b><\/h3>\n
Corey Nachreiner<\/b><\/h3>\n