Ask IT helpdesk or MSP what the most common topic of IT support calls is and you could place large bet that it will relate to passwords. It’s no surprise that users hate passwords. Today, more than ever, we all have a huge amount of different passwords for all of our online services. The headache of managing these can lead to users taking some very risky shortcuts, which can have very serious implications for your company’s cyber security. A lot of these practices can be mitigated with a solid password policy.
The five common passwords are: ‘123456’, ‘password’, ‘qwerty’, ‘12345’ and ‘123456789’. All of these could be easily cracked by a human being, let alone any type of hacking tool. These could also be all but eliminated in your business if a password policy is enforced. So here are some easy rules to put in place to get your users to create stronger passwords and to make your network more secure. These can all be easily enforced with network logon policies.
1. Set longer, more complex passwords
The longer the password, the more possible combinations it can be and the more secure it is. Try enforcing a minimum 8-character password for users and a 14-20 character password for higher level admin passwords or ones that will never expire. These passwords can be made stronger still by adding punctuation or special characters. This complexity makes passwords very difficult to crack.
2. Change passwords often
This will be the one that your users will struggle to warm to the most, but it is possibly one of the most important ones to consider. Forcing a password change every so often not only reduces the chances of a password being compromised from an external source, but also helps mitigate issues such as disgruntled former employees using a password they remember to potentially gain access to sensitive information after they leave.
3. Use a password manager
How many people do you know that write their passwords down on post-it notes or sticky labels on their monitors? The reason people do this is simply because remembering all these passwords can be a nightmare. Use of a password manager such as Keepass, 1Password or LastPass can eliminate both the need to remember the passwords and users writing them down. These services are very secure and offer features like browser plugins, so the correct password is entered automatically without users needing to type anything. Password managers are especially useful if you have teams of people that share passwords for various things as they are all kept in one, central location.
You can be more strict or more flexible as you see fit, but the rules here are a great starting point for any business which needs to tighten up on cyber security.
At Nimbus CS we can implement harder authentication methods, such as two factor authentication. When you logon with two factor authentication, in addition to your normal username and password, you need to clear a second logon stage. This stage may involve approving the logon via a prompt on your smartphone or inputting a code from a text message. Call Nimbus CS for a chat to find out more.