Skip to content

Password Strength: How to Create Strong Passwords for Credentials?

Having an efficient password policy is critical to the cybersecurity of companies. Since using easy-to-identify passwords is a way to facilitate scams by malicious actors. For the same reason, repeating passwords is a risky practice.

In 2021, more than 8.4 billion passwords from people all over the world were leaked and posted under the name ‘rock you 2021‘ in an online forum. What did they have in common? They used between 6 and 20 characters, without spaces, numbers, or symbols.

Other characteristics of easy-to-steal passwords are: using birthday or algorithms with repeated numbers, proper names, numerical combinations, and the word Brazil are also often found in leaked passwords of Brazilian users, in addition to the sequence 123456.

We have prepared this article especially to help you keep your company protected. In it, we will propose positive actions for an effective password policy. They are as follows:

  • Change Passwords Frequently
  • Use Software that Alerts You About the Change
  • Join an Account Lockout System
  • Train Your Employees
  • Do Not Use the Same Password for All Accounts
  • Create Strong Passwords
  • Have a Password Manager
  • Adopt Multifactor Authentication in Your Company’s Routine

Read it until the end!

Why Should You Adopt a Secure Password Policy?

We know hackers take advantage of the weakness of corporate passwords in most cyber-invasions. 

Therefore, regardless of the size or industry of an organization, it is essential to have a secure password policy. After all, by adopting it, one avoids invasions that generate inconvenience and financial losses, in addition to preventing the company’s credibility from coming into question.

In practice, the password policy establishes rules to be followed by the entire team, ensuring the adoption of security requirements when creating passwords for accessing corporate devices and systems.

In the next topic, we cover some criteria you should adopt when establishing a password policy for your business. 

 

Positive Actions for an Effective Password Policy

You now understand the importance of creating a secure password policy for your company. Now, let’s show you how this can be done. Keep reading our text!

  • Change Passwords Frequently

It is believed that using the same password in different applications and services can facilitate the access of malicious users, and when we reduce the number of accesses with the same password, we also reduce the possibilities that they are shared and available for access by third parties.

However, the usefulness of this measure has been questioned. Microsoft itself stopped asking for the periodic change of passwords, considering this method useless. According to this report in Isto É Dinheiro, Aaron Margosis, a cybersecurity consultant at Microsoft, stated it is necessary to change the password only if it is stolen.

Despite this debate, the periodic change of passwords has still been recommended, for this reason, we explain about software that emits alerts when it is time to change them in the following topic.

  • Use Software that Alerts You About the Change

There is specific software that warns about the need to change passwords. They work as follows: when you try to access the computer after some time, you see a pop-up, warning you about the need to change your password to proceed. If you don’t, you will not be able to access the system.

These pieces of software are very useful because, over time, it is very common for people to get comfortable and fail to change their passwords within a certain time.

  • Join an Account Lockout System

Blocking accounts is a very important practice that prevents access after a certain number of attempts. This feature prevents the user from trying to access a system by testing multiple passwords until they reach their goal. This practice is known as brute force and is often used by malicious attackers to gain unauthorized access to these systems.

To get a sense of the importance this feature has, it is widely used by e-mail services and various websites.

  • Train Your Employees

If you are at the head of an organization, you should know that in addition to investing in technology to ensure information security, you need to train your employees through awareness and training to make it possible to identify and avoid threats.

Many people are unaware of the risks involved in accessing corporate systems. In these cases, it is necessary to introduce good practices and enforce them to prevent cyberattacks, including password theft. 

It is also important that these pieces of training are constant, since technology advances every day, as well as the techniques used by malicious agents.

  • Do Not Use the Same Password for All Accounts

If someone manages to steal your password from social media, for example, it is very likely they will test it on your other services, causing much more damage if you use the same password to connect to different online platforms.

Therefore, when establishing a password policy, remember to recommend that your employees have a different password for each online environment they access.

  • Create Strong Passwords

It is not enough to use passwords to access systems. It is necessary to resort to strategies that make it possible to increase the security level of the passwords used. After all, hackers often analyze users and attempt the invasion by testing obvious possibilities such as birthdates, relatives’ names, and short words.

In these cases, we recommend using a minimum number of digits, combining uppercase and lowercase letters, numbers, and symbols.

  • Have a Password Management Solution

If you follow the fifth and sixth tips in this article, your employees will have to remember a lot of complex passwords, which can be quite difficult. That’s where a password management solution comes into play.

This feature is capable of storing passwords, facilitating the work of users, who only need to remember the password used to access this system. What’s more, password managers still suggest codes that are unlikely to be discovered. 

Of course, like all other apps, they can be breached. Therefore, it is essential to use an extremely secure master password.

  • Adopt Multifactor Authentication in Your Company’s Routine

One of the ways to create a secure password policy is to adopt multifactor authentication (MFA). This solution brings together different mechanisms to prevent intrusions, which are:

  • Knowledge Factor: something the user knows, such as a password;
  • Ownership Factor: something the user owns, such as a token; and
  • Inheritance Factor: something that relates to who they are, as in the case of biometrics.

But remember an important detail: in the multifactor authentication, the mechanisms must be independent of each other to guarantee the protection of a system. This means that if one of the factors gives access to the other, your organization is not protected.

By reading this article, you learned what you should do to create an effective password policy for your organization. Did you like our text? Share it with someone else who is interested in the topic. 

 

ALSO READ IN SENHASEGURA’S BLOG

High Availability: Technology that Guarantees Productivity and Credibility

China has Published Its Specific Law For the Protection of Personal Data. What Are The Implications?

My Company Suffered a Ransomware Attack: Should I Pay the Ransom or Not?

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

QA, the acronym that can save your life (or your company)

Do you already know what tasks the QA department performs? Would you like to discover what each QA tester does on a daily basis? You don’t know what the hell we’re talking about but you’re intrigued and can’t stop reading because my prose is enigmatic and addictive? Well, you’ve come to the right place! We’ll tell you how our QA department manages so you can learn what yours does without having to ask. Read on and don’t forget to propose me for the Nobel Prize for literature when the time comes!

Do you already know what tasks the QA department performs?

Starting with the functions of the department, QA is in charge of testing Pandora FMS and making sure that we offer the best possible quality to our clients and the community. It is an extremely complex task because Pandora FMS is very large and it could be said that chaos theory is well applied, since inserting an “&” character in a form field can cause a report that had nothing to do with it to fail. So be careful, any day your building could burn for the wrong character! From Pandora FMS we recommend hiring only professionals

Currently, our QA team is made up of Daniel Ródriguez, Manuel Montes and Diego Muñoz, although from time to time, colleagues from other departments support them to carry out specific tests. They are thick as thieves. They always sit together at company dinners and share a bottle of Beefeater after dinner.

QA Tester Team 

Daniel Rodríguez, “The beast (QA) of Metal”

Works together with the Support and Development Departments. He is devoted to testing new features and finding possible bugs to help improve the product. He loves sci-fi movies and metal:

“My duties as department head are mainly to manage and supervise the work of the department, design and improve test plans, carry out manual tests and coordinate communication with the rest of the departments.”

Manuel Montes

is from Madrid and began as part of the Development department, although he later joined the QA team. He loves cycling when the weather allows it, watching movies, reading and going for a walk with his family

“In addition to manual tests, we carry out automatic tests with technologies such as Selenium Webdriver and Java to interact with the browser, Cucumber with Gherkin language so that the tests to be carried out are somewhat more understandable for less technical colleagues and, in turn, serve as documentation, and Allure to generate reports with the results of said tests.”

Diego Muñoz, “The Gamer Alchemist”

is a QA tester, although he also helps the Support team, solving different problems for customers. He is from Huelva and although he has lived there all his life, he has no accent, which he boasts about. His hobbies range from watching movies, to video games, listening to music and watching series:

“Every piece of code that is implemented in Pandora FMS goes through my hands or through those of one of my colleagues, who judge if the changes work correctly or have any errors. We also sometimes suggest alternative ways to present features to developers or to solve the bugs that we have been able to find. In addition, in the days prior to the product release, we review the whole console in all its Metaconsole, Node and Open variants, once again making sure that the code introduced in the new version works as well as possible.”

The importance of the QA department

From the QA department, an average of 180 tickets are generated per release and, as you know, we present 10 releases a year. This adds up to more than 1,800 tickets annually, how cool is that? Sometimes it is a heinous job, because it involves throwing back the work of a Development colleague, and also difficult because it is impossible to see everything, and when a problem explodes in a client’s environment, it attracts all eyes. Although QA work has little visibility and can be very thankless, it is fundamental to the success of everyone’s work and the final product.

If you want to find out more about our departments out of curiosity or for the simple fact that this way you can find out more about yours, you can request it in the comments box, one of our busy social networks or by post, which is a little bit outdated but should totally come back. Scented letters and vermilion sealing wax. There can’t be anything more romantic!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Nmap Advanced Uses Pt.1

Intro

If you’re familiar with Nmap, you are probably aware of the myriad of options it has to offer. I have opted to use example scans for our purposes in hopes of being able to more easily demonstrate some of those options. 

Continue reading

ESET recognized as a Top Player in Radicati’s APT Protection Market Quadrant for the third year in a row

SINGAPORE – March 10, 2022 – ESET, a global cybersecurity leader, has been recognized as a Top Player for the third year in a row in Radicati’s 2022 Advanced Persistent Threat (APT) Protection Market Quadrant. The report evaluates 10leading security vendors for their APT Protection solutions, particularly assessing their functionality and strategic vision, with ESET’s Top Player status signifying continued excellence in this field.

APT groups are responsible for some of the most infamous campaigns targeting organizations all over the world, making APT Protection essential for businesses of every shape and size. More than being a single antivirus or anti-malware solution, APT Protection is classified by Radicati as “a set of integrated solutions for the detection, prevention and possible remediation of zero-day threats and persistent malicious attacks.” APT Protection solutions include in ESET’s case solutions such as an XDR-enabling enterprise management platform (ESET PROTECT Enterprise), advanced threat defense (ESET LiveGuard Advanced), endpoint detection and response (ESET Inspect), reputation networks (ESET LiveGrid®) and threat intelligence (ESET threat intelligence feeds and APT reports).

Jakub Debski, ESET’s chief product officer, said: “ESET’s prevention technology is the most densely multilayered and effective in the industry and we’ve created a wealth of diagnostic systems to detect and halt malicious code. Altogether they work as an extended detection and response, or XDR, solution that delivers enterprise-grade security and risk management capabilities, including advanced threat hunting, incident response, full network visibility, cloud-based automated threat defense, and more.”

In Radicati’s report, ESET’s cutting-edge enterprise security solutions, such as ESET PROTECT were highlighted for offering a unified single-click security management platform with XDR-enabling and threat hunting capabilities. In particular, ESET Inspect, the cloud-delivered XDR-enabling component of the ESET PROTECT platform, available as a cloud or on-premises solution, was cited as one of the strengths among ESET’s offering.

“We are delighted to be recognized as a Top Player in Radicati’s 2022 APT Protection Market Quadrant for the third year running. At ESET, we are committed to being a trusted partner to our customers and this achievement is testament to our consistency and one of ESET’s core values of integrity. Technology innovation is moving at pace, which means we continue to evolve our product portfolio to cover even the most advanced persistent threat scenarios. Receiving industry recognition in Radicati’s report is, therefore, further evidence that we are on the right path,” added Debski.

To read more about the 2022 Radicati Market Quadrant: Advanced Persistent Threats Protection, please click here, and to read about ESET’s expansive product portfolio, please click here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

How does it feel to discover a Zero-day Vulnerability at 21?

Mykhailo Dovhanych, 21, our Pentester has become a local celebrity. He made the digital world a bit safer by discovering a Zero-day vulnerability and getting his first CVE. We asked him a couple of questions to learn more about this exciting story:

UnderDefense: What is the official name of your position in the company?
Mykhailo: I’m a Penetration Tester, but personally, I prefer to call it Red Team Operator (laughing).

UnderDefense: When did you decide that you want to work in the CyberSec industry? Why?
Mykhailo: I`ve been into cybersecurity since 2019 when a couple of my friends decided to go to military universities. I planned to join them, but then I realized that cyberspace is the “5th field” of war, the most interesting for me. I felt like I could definitely make a contribution there. So I made the decision to advance in Offensive Security.

UnderDefense: What software was this vulnerability found in?
Mykhailo: I found it in Pi-hole. Pi-hole is a free, open-source software for Linux that acts as a DNS sinkhole and ad blocker. It is designed to run on a Raspberry Pi, but can also be installed on other Linux-based systems. Pi-hole blocks ads by routing DNS queries for known ad-serving domains to a “black hole” effectively preventing ads from appearing on devices that use it as their DNS server.

UnderDefense: Who uses Pi-hole? How many people could be affected?
Mykhailo: These are individuals and organizations that want to block unwanted ads and trackers on their network, including homes, small businesses, and schools. Also, it is used by individuals who want more control over their privacy and security when browsing the internet. There is no exact data regarding Pi-hole installs and active users, but approximately hundreds of thousands could have been affected, possibly even more than half a million.

UnderDefense: What is the nature of the vulnerability you found? 
Mykhailo: The vulnerability is that attackers could access information about domains from these blacklists created by the administrator. These blacklists contain confidential information that should not be disclosed. Since tracking domains are constantly changing, it’s not easy to record all of them and keep the blacklists updated. So updated lists of such domains are sold on the internet and you can buy them for a few dollars. In this particular case, the client who buys and implements such a list is in danger. Attackers can obtain these lists for free by exploiting the vulnerability. When we announced it to the developer, it had a “Zero Day” status, meaning that all versions were vulnerable.

UnderDefense: Was this vulnerability fixed?
Mykhailo: With the help of search engines Shodan, ZoomEye, and special Google Dorks, it was possible to select publicly available DNS servers and get all blocked domains from them. Currently, there is an updated version of the Pi-Hole Admin Panel without this vulnerability.


You can learn more about the above-mentioned CVE here:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23513

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About UnderDefense
UnderDefense, a globally top-ranked firm by Gartner and Clutch, provides cyber resiliency consulting and technology-enabled services to anticipate, manage and defend against cyber threats. We empower clients to predict, prevent, detect, and respond to threats.

Need help? Our team is just a message away