Password management refers to a collection of best practices designed to guide users towards storing and managing passwords to prevent unauthorized access.

BEST PRACTICES FOR EFFECTIVE PASSWORD MANAGEMENT

Improve Password Criteria

A recent study on password reuse shows that one out of every 142 passwords is “123456”. This means that despite the increase in awareness, many users still opt for the simplest of passwords. To mitigate this problem, you should improve the passwords you select and follow strong password conventions. This usually requires selecting a combination of lowercase and uppercase letters, numbers, and special characters.

Use Two-Factor Authentication (2FA)

Two-factor authentication combines username and password with an extra means of identification. Passwords have proven to be less secure on their own. However, enabling 2FA reduces the likelihood of getting hacked even when your password is compromised. For instance, 2FA may require you to combine your username/password with codes sent to your mobile phone or even scans of your fingerprint.

Use a Password Manager

A password manager is software for storing, generating, and managing your credentials. The benefits of using a password manager include the following:

• Create long and complex passwords with ease
• Increased productivity since many password managers automatically retrieve saved passwords for detected websites
• Time-saving since you don’t have to remember passwords for all websites or databases you visit

Change Default Credentials on Your Home Devices

Since the coronavirus pandemic broke out, working remotely has become the new norm. This means that many employees have had to rely on their home internet to work, requiring added attention to cyber security for home devices. For example, most routers ship from manufacturers with a default password built-in. It is expected that the end user will change the password once they have gained access to the router; however, this isn’t always the case. A drawback of not changing the default credentials is that they are commonly known by hackers and susceptible to attacks that could hijack your network.

POTENTIAL DANGERS OF POOR PASSWORD MANAGEMENT

Brute Force Attacks

Brute force attacks can be likened to trying every key on a ring to open a door. They consist of an attacker systematically submitting many passwords until the correct one is found. Nowadays, hackers rely on automated tools as they repeatedly try to gain access to your systems. However, since hackers mostly use common password combinations, you should be less susceptible to this type of attack by using a strong password.

Credential Stuffing

Although this is a type of brute force attack, it operates differently. Credential stuffing exploits our human tendencies to reuse passwords. It involves using lists of usernames and passwords combinations that may have been exposed in data breaches from other platforms. For example, if you were affected by the Yahoo data breach and still use the same username and/or password on other platforms, your credentials are already compromised and should ideally be changed. The attacker automates the logins using tools designed specifically for these types of attacks.

Business Email Compromise (CEO Fraud)

This is one of the biggest dangers of poor password management. In 2019, business email compromise accounted for losses of up to $1.7 billion for enterprises in the US alone. This usually involves hackers using compromised business email accounts to intercept payment requests. This is a scam targeting employees who conduct wire transfers where email accounts of high-level employees involved with wire transfer payments are either spoofed or compromised to do fraudulent transfers.

In recent times, this threat has evolved beyond money to target personally identifiable information. For example, hackers have been known to use compromised emails of business executives to make HR requests like W2 information of specific employees. Click here for a more detailed overview of CEO fraud.

The Bottom Line

When managed poorly, passwords can create more vulnerabilities for businesses. Combining poor password hygiene with an unsecured device to access an enterprise’s network could have damaging effects. With 30% of ransomware infections in 2019 occurring as a result of weak passwords, businesses will need to improve password management to prevent a repeat of this in 2020.

Now go change your passwords!