Password strength is one of the criteria considered when creating password policies. After all, this is one of the most efficient measures to prevent passwords from being breached. And worrying about this is of paramount importance for organizations today.

This is because the use of weak passwords is one of the major reasons for data leaks in Brazil, and many Brazilians still opt for passwords that are easy to discover, such as the sequence 123456, the password word itself, family and football team names.

With that in mind, we have broken down the subject in this article, explaining more details about password strength and its importance for information security. To facilitate your understanding, we divided our text into the following topics:

• How Important is the Strength of a Password?
• Five Steps to Create a Strong Password
• Periodic Password Changes: Are or Are They Not Important to Ensure Security?
• Two Tips for Memorizing Passwords
• Use Two-Step Verification or Multifactor Authentication to Protect Credentials Are Password Strength Meters Reliable?

How Important is the Strength of a Password?

A strong password has the function of preventing your accounts from being hacked by malicious actors, as a weak password can easily be guessed by a malicious user, exposing you to data theft and extortion.

If you are at the head of an organization, you have the aggravating factor of losing data from customers, partners, suppliers, and employees, which can bring great financial damage and damage to the credibility of your company.

What’s more, with the constant evolution of technology, it is not enough to just worry about human hackers. Today, there is software capable of evaluating the behavior of users, in order to guess the chosen password.

Some programs even perform combinations of words found in dictionaries and imitate patterns based on easy-to-memorize passwords, harming password strength. 

We also point out that personal information exposed on social media, such as birthdays and names, also works against you and in favor of those who want to discover your passwords.

Five Steps to Create a Strong Password

Now that you know the importance of password strength, here’s what you should do to create a strong password and ensure its security:

• Opt for long passwords: Short ones are easier to identify, so we recommend you set a password of at least 12 characters, however, we advise that the ideal is to use 14 digits or more;
• Create a complex combination: One of the ways to ensure password strength is to gather numbers, upper and lower case letters, and symbols to make it difficult for cyberattackers;
• Do not choose words that can be found in dictionaries, proper names, product or company names;
• Do not reuse previously used passwords;
• Words written backward are not an adequate solution to guarantee password complexity;
• Think of a password you are able to memorize, even if it is difficult for others to guess.

Periodic Password Changes: Are or Are They Not Important to Ensure Security?

Periodic password change is a widely recommended measure to ensure password strength, but it has been the subject of some debate. Microsoft, for example, which used to recommend changing them every 60 days, started to consider this method useless and dangerous.

That’s because people tend to create their passwords based on easy-to-identify references, as explained above, and when they change their passwords, they make minimal changes to the words or numbers used. That is, if the hacker knows the victims’ current password, they will have many chances to discover the new code.

In addition, the malicious actor can use passwords already leaked in other security incidents to reuse them in other services. This practice is called credential stuffing, or password reuse.

Do you want to find out if your password has been breached to know if you need to replace it? senhasegura Hunter is the ideal service for you. It indicates leaked credentials and what data has been compromised. You can even make a free consultation by clicking here, with the assurance your email will be used exclusively for this purpose. 

Two Tips for Memorizing Passwords

To ensure password strength, you will have to create complex and unique passwords. Therefore, you may have difficulty remembering which numbers, letters, and symbols were chosen for each one. Therefore, we prepared some tips for you to memorize these characters. Check it out:

Use a Password Manager

We know remembering all passwords can be a burden for users. Therefore, we recommend using a password manager that allows you to store them, as well as suggest and create strong passwords. But remember you will need to remember at least one access, from the manager itself, and this must be difficult to identify, otherwise, the program could be violated and expose the other passwords.

senhasegura is one of the solutions that can be used for the proper storage and management of passwords in your company.

Create a Rule to Make Memorization Easier

You know you must use a unique password for each platform or service you access, but you can follow a single logic to create all your passwords. 

Another tip is to think of a phrase and shorten it to take advantage of its initials to create a password that is not obvious. However, do not forget the need to mix uppercase and lowercase letters, numbers, and symbols in order to ensure password strength.

By following these tips, you are more likely to memorize your accesses, even if they are complex codes. 

Use Two-Step Verification or Multifactor Authentication to Protect Credentials

When it comes to protecting your credentials, you should not limit yourself to criteria that guarantee password strength. Some features can be very efficient to ensure your cybersecurity.

One of them is two-step verification, also known as two-factor authentication (2FA). This is a mechanism that requires a second piece of data to give access to accounts, commonly in the form of codes sent by SMS or even an application token.

However, we recommend you do not use text messages, as your mobile number can also be hacked. To generate codes through a token, it is possible to use authentication applications, such as:

• Authy;
• Google Authenticator; and
• Microsoft Authenticator.

Multifactor authentication (MFA) consists of a tool that uses at least two mechanisms to authorize access to online systems, inhibiting the action of criminals. The methods used are knowledge factors (passwords and codes), possession factors (tokens), and inheritance factors (such as fingerprint and facial recognition).

Are Password Strength Meters Reliable?

When you create a password and enter it on a platform, it can be classified by the password strength meter as weak or strong, receive a score, or even be associated with the colors green, yellow, and red. With this information, you have the opportunity to rethink your chosen password and adopt a more complex code.

However, it is very common for people to question the efficiency of these password strength meters, which use algorithms to tell you if the password is strong in a situation of brute force attacks. The most problematic thing is that this type of attack is already old and today there are even dictionaries with lists of the most used passwords and patterns.

One exception to the rule is zxcvbn, which includes these patterns in its analysis and, according to experts, is the best choice when it comes to a password strength meter. It is not an infallible technology, but it is certainly ahead of the rest. 

Another feature you can use to ensure password complexity is a password generator. This tool makes it possible to create different combinations of characters automatically and randomly, making it difficult for intruders to work. 

Reading this article, you had the opportunity to:

• Learn more about the importance of password strength, one of the main recommendations when creating password policies, as it is a powerful action against intrusion attempts by malicious agents;
• Get precious recommendations for creating strong passwords (use of long combinations of at least 12 characters; in a complex way, gathering numbers, upper and lower case letters, and symbols; without words that can be found in dictionaries, proper names, product, or company names, etc);
• Learn about practical tips to memorize your passwords more easily, as in the case of using access managers;
• Understand about other effective ways of protecting credentials, such as two-factor authentication (2FA) and multifactor authentication (MFA);
• Know whether or not password strength meters are reliable.

 Did you like our content? Share it with someone else who might be interested in this information.

ALSO READ IN SENHASEGURA’S BLOG

High Availability: Technology that Guarantees Productivity and Credibility

Invest in Disaster Recovery Strategies and Avoid Damages to Your Company

Why Identity and Access Management is Important for LGPD Compliance

With the coronavirus pandemic, companies had to adapt and reframe their businesses, which brought many benefits in terms of growth and digital presence. Home office and hybrid jobs are already a reality for most companies, especially technology ones; physical servers are being moved to cloud environments; and companies had to change the way they present themselves in the market and relate to clients, using large volumes of data combined with tools and Artificial Intelligence as the main resources to improve business strategies and increase sales.

These positive changes in the digital transformation, in turn, have created an almost complete reliance on technology, increasing companies’ exposure to vulnerabilities and cyberattacks such as cloud server hacks, leaks, and data hijacking. The current context forces organizations to go through this transformation process, without which it is impossible to evolve. 

Therefore, all business leaders must be aware of the dangers they are exposing their business to and are prepared to protect themselves and deal with these risky situations as assertively as possible. From the users’ point of view, it is important to pay attention to the protection of their own data and put aside some habits of insecure behavior in the virtual environment.

Check out the main effects of the pandemic on Information Security, according to research released by IBM Security and Kaspersky data.

Increased Attacks in Cloud Environment

Due to the pandemic, many companies are moving to the cloud environment, which increases the flow of data and, consequently, the risk of threats and attacks. Work previously performed on a machine under the supervision of the company’s IT staff is now performed on a machine handed over to the user, with little or no control by the information security team. 

The companies’ IT infrastructures are also freed up for remote access on the employees’ own machines. All these factors increase the chances of attacks.

Another concern, according to IBM, is the fact that Linux is the main responsible for workloads in the cloud (about 90%) and a good part of malware attacks are related to this operating system, which only tends to increase the attacks in cloud environments that use these virtual machines. 

Cybercriminals Are Impersonating Famous Brands in Online Shopping

It is no surprise that the pandemic has generated an increase in online purchases. As a result, cyberattacks have also become more frequent, and the lack of information from many consumers on how to shop safely online is also a fertile ground for this. 

According to an IBM report, cybercriminals are posing as consumer-trusted brands more often. Adidas was one of the brands that drew the most attention from the attacks, due to the high demand from consumers for coveted products. 

The launch of a brand model in 2020 may have increased this wave of attacks. Users were directed to pages identical to the original ones and, when making payments, cyber criminals tried to steal financial information, passwords, personal information, and even break into the victim’s devices.

Ransomware Attacks Were the Biggest Since 2019

A ransomware attack takes place through malicious software that blocks access or encrypts the data on the system, network, or computer of companies and/or users. Generally, cyber criminals ask for millions of dollars, mainly from prominent companies and people, in exchange for returning these accesses.

Social distancing and the practice of home office during the pandemic have intensified ransomware attacks around the world. “People stayed at home and had time to explore vulnerabilities in systems and critical infrastructure,” explains Apostolos Malatras, leader of the knowledge and information team at ENISA (European Agency for Network and Information Security). 

According to numerous recent research, this category of scam is becoming increasingly popular, particularly on corporate networks, as they can offer higher amounts in exchange for regaining access to data.

In Brazil alone, there was a 350% increase in this type of attack, just in the first quarter of 2020, according to data from Kaspersky. Also according to these data, the country leads the ranking of the largest number of companies attacked by this type of threat during the pandemic. 

Ransom figures have increased a lot and created a very profitable business for criminals. According to Fabio Assolini, an expert at Kaspersky, in addition to a greater guarantee of profit from attacks on organizations, this increase was also due to the recent drop in the price of Bitcoin, the main digital currency used by hackers. 

According to the expert, “Criminals know that companies and individuals are more vulnerable and accessing corporate networks from potentially unprotected devices. This increases the risk”.