Understanding what a password policy is, is the first step in being able to build a strong one.
These are a set of rules covering how you design the combinations of words, numbers and/or symbols that grant access to an otherwise restricted online area. Passwords can protect your website, software programs and small business networks. They keep them safe from unauthorized entry from ex-employees, curious intruders and of course hackers.
A password policy is a companywide set of guidelines and rules to insure all employees and staff have secure passwords when accessing sensitive data.
Using Numbers and Symbols As Letters
Understanding what a password policy is, is the first step in being able to build a strong one.
These are a set of rules covering how you design the combinations of words, numbers and/or symbols that grant access to an otherwise restricted online area. Passwords can protect your website, software programs and small business networks. They keep them safe from unauthorized entry from ex-employees, curious intruders and of course hackers.
A password policy is a companywide set of guidelines and rules to insure all employees and staff have secure passwords when accessing sensitive data.
Using Numbers and Symbols As Letters
This rule helps you to build passwords that are strong as steel. Using numbers and symbols as letters can easily stop unauthorized use.
Examples:
A = 4, /-\, @
D = |), |}, |]
H = |-|,]-[, |=|
N = |\|, /\/, /V
S = 5, $, §
Keep Symbols/Numbers Separate
Here’s another hint for an effective password policy to foil hackers. Make sure the numbers and symbols are spread out through the password. Bunching them up makes the password easier to hack.
Don’t Make It Personal
Everyone involved in a small business needs to understand there’s a big difference between security and convenience when it comes to passwords. It needs to be clear using personal information like your first name and birth date is a recipe for disaster. If a hacker ever gets his hands on company HR data, this information will be the first set of combinations he tries.
Use Different Passwords For Different Accounts
Even if there are several computers in the same department, it’s a bad idea to cut a corner by using the same password for each. Use a different one for every device, for every login, for every website, always.
Avoid Dictionary Words
It might sound safe to go to the dictionary for a password, but hackers actually have programs that search through tens of thousands of these words. Dictionary attack programs have been around for years.
Keep The Character Limit Down
The average person can only remember 10 characters or less. Long passwords run the risk of being written down so they can be remembered.
Adopt Passphrases
Abbreviations are usually immune to dictionary attacks. So TSWCOT for The Sun will Come Out Tomorrow is a good choice for a secure password. Remember to add symbols and numbers.
Don’t Change Them Too Often
A good strong password will last for a year or more. Don’t encourage employees to change them any more frequently than that. Otherwise you can wind up with a password1, password 2 situation. Hackers look for these patterns.
Don’t Write Anything Down
Granted, committing all your passwords to memory might get tricky. However, everyone under your small business roof needs to understand not to write anything down. A discarded Post-It can be all a would be hacker needs.
Discourage Sharing
No one should share passwords over any electronic media. If you can’t find a way of sharing a password without using cyberspace, make sure everyone knows to change it right away afterwards.
Encourage Weirdness
In the passwords and not your employees, that is. Still, they should understand the best passwords avoid pop culture and sports terms and anything that’s common. Random groupings of the 8+4 rule works but so do unique phrases.
Adopt Stronger Policies for Sensitive Accounts
Administrators need to have more robust rules for setting passwords. The more data they have in their electronic baskets, the stronger the policy needs to be.
Enforce The Policy
It’s important your password policy has disciplinary teeth. Be clear about what happens for infractions all the way up to dismissal.
Set A Lockout
We’ve all legitimately forgotten a password and need a few tries to get back in. However, you should set a number that will lock the user out after a few unsuccessful attempts. Four failed logins works.
Stay Away from Known Acronyms
Don’t use these as a shortcut to identifying your department or who you are. It might be temping for an accountant to use CPA. However, that opens a cybersecurity door wide enough for a hacker to walk right through.
Never Use “Remember Password”
Search engines and email programs mean well when they ask you this, but in the end it’s just another risk your small business doesn’t need to take. Using remember password is a sure way to forget passwords.
Never Tell Anyone Your Password
A good policy will stress that no one should ever tell anyone else their password. The systems administrator needs to play gatekeeper here. If someone wants to know a password, they need to go to them.
Keep the Process Private
Finally, stress to everyone involved they need to hide the process from prying eyes. No one should be watching when you type in your password.
As a company specializing in online network security and email applications, we understand password security. Looking to level up your company’s password protection? We’ve had great success with products like RoboForm, Passportal, and IT Glue.
Want to learn more about preparing your business for cybersecurity?
Give Capitol Communications a call today at 307-635-9295. We would be happy to discuss the security of your online data.