Strong Password Protection and Policies - Tampa, Florida

Strong Password Protection Policies - Questions and Answers

A sound password policy alone won't guarantee your computer’s security, but you have little chance without one.

It's easy to see why. Type the words "password hacking" into any of the major search engines, and you will be rewarded with a bevy of tools offered for various platforms. Individual posts on some bulletin boards also request password-hacking tools for specific systems.

Passwords are the first line of defense. If not handled correctly, "passwords are the weakest link in the enterprise," says Robert Lonadier, president of RCL & Associates, a security consultancy in Boston. "Insiders being far-and-away the biggest threat to a company, a weak- or nonexistent-password is the easiest vulnerability to exploit."

A weak password is one that can be easily-guessed or broken-into with one of the widely-available hacker tools. It's not just a matter of someone guessing that your password is a combination of your kids' names, your birthday or anniversary date, or a childhood nickname that you still go by. Some of the hacker tools use dictionaries to test passwords against thousands of commonly used words.

The best passwords use a combination of upper- and lower-case letters and non-alphanumeric characters like the asterisk, exclamation point, dollar sign or percent sign. Best of all is to combine words and characters into a password that can't be found in the dictionary, something like "touch*vote," Lonadier suggests. It's also memorable, he says, a key problem with some passwords.

Indeed, that is often the biggest problem with passwords; They're so difficult to remember or are changed so often that people put them on yellow sticky notes attached to their monitors.

And so, in addition to passwords that can't be easily guessed, it's critical to have an accompanying policy: what happens when people forget their passwords, for instance. "How will I know it's you if you're in a remote office?" Lindstrom asks. "You subvert the policy if all you have to do is call the help desk to get your password. You have to figure out how strict you want to be."

One type of technology that can help counter password hackers is automatic log-out. "You can relax the strength of your password policy if you have three strikes and you're out -- a person is locked out for some length of time if they enter wrong passwords three times," Lindstrom says. "If someone can keep battering, it's only a matter of time before they can get in."

Other Areas We Service Include: