Sign up for our Newsletter
Keep up to date with the latest IT news, tips and guides from Dragon IS and sign up here:
Passwords are often the first line of defence when it comes to cybercrime and with the world increasingly going digital, we’re now faced with remembering more of them than ever before.
It’s estimated that the average worker now has to keep track of around 200 passwords. So, it’s no surprise that password fatigue can easily setting in, leading employees to opt for weak and easy to crack passwords. For example, ones based on personal information, a child’s or pet’s name, or a favourite sports team.
Millions of people are even still using Password and 123456!
Despite knowing the risks, 61% of people also admit to using the same (or similar) passwords everywhere, further adding to the risk of a successful hack.
For businesses, this can be a big problem, leaving a potential ‘way in’ for criminals. So, it’s vital to have a password policy in place and to take all steps necessary to help educate employees and mitigate the risk.
Some of the most commonly used and easily hacked passwords worldwide are:
Password – used by nearly 5 million people.
123456 – 1.5 million
123456789 – 413,000+
qwerty – 309,000+
12345678 – 284,000+
111111 – 229,000+
12345 – 188,000+
123123 – 127,000+
How are passwords discovered?
There are various techniques that an attacker might use to discover passwords. These include:
What can businesses do to enhance password security?
Supporting employees to gain a greater understanding for the issue is a vital piece in the puzzle. Advising on best practice when it comes to the choice and use of passwords is a great first step.
Create a company password policy
Think about and document how your business is to use passwords. This policy should be shared with employees and reviewed regularly. It should cover issues such as:
Schedule team training
Research points to the fact that relying on employees’ own intuition and understanding of cyber security is not enough. You need to be proactive and to support them, as the consequences of a cyberattack could be extremely costly. Hold regular training sessions with employees and share news about the latest scams and what action to take, should someone come across something they’re not sure about.
Don’t change passwords too often
A strong password should only need to be changed around once a year. Certain software can now automatically issue a prompt for a password to be reset at a required interval. The password should be entirely changed, to avoid patterns like this happening, which are looked for by hackers…password1, password2, password3
Use random passwords
Generate and use random passwords using an online generator such as Last Pass. Make it compulsory for these types of passwords to be used. Again, some software will let you prevent people from setting passwords that are too easy, so they would be stopped even if they tried to.
Set up password blacklists
By this we mean make sure your users can’t choose any passwords commonly found within data breaches, like 12345 mentioned earlier. A helpful site for this is Have I Been Pawned? which can also be useful for checking to see if an email address has ever featured in any website data breaches and when.
Use a password manager
The more passwords there are to remember the more difficult it can be for an employee (and the more tempting for them to replicate or choose easy ones). One solution is to use a password manager. This type of tool remembers passwords for numerous sites, so all an employee needs to do is to remember the main login for the password manager software itself.
Implement two-factor authentication
This is where a one-time passcode may be sent to a phone linked to the particular account. The code must be entered before access is granted, acting as further verification.
Concerned about your business IT security or cyberattacks?
Here at Dragon IS, we work with small and medium sized businesses, helping them with a broad range of issues relating to their IT systems, processes and procedures. From expert advice and guidance, to introducing systems that can effectively scaleup with a growing business, call us for an informal chat on 01908 613 080 or email email@example.com