Passwords are a common method of protecting information and they are used every day in all kinds of situations.
However passwords face numerous threats that could put your data in to the hands of organised criminals, or those more close to home. Here are some things to think about.
People Problems
– Being Over Looked.
With the increase in mobile devices and extended battery life, accessing protected accounts in public places is increasing. But next time you unlock your smartphone on public transport or sign in to social media in a coffee shop window, consider who could over look you – including those who are monitoring CCTV cameras.
– Writing Down/Displaying.
With so many passwords to remember its tempting to write them down, but when you do it becomes much harder to control who sees them.
– Disclosing to Friends/Colleagues.
Passwords can often be seen as a barrier when you need to share information or cover for a colleague, but disclosing them to friends and colleagues is like giving away your identity. Any actions performed under your account login will be attributed to you.
Technical Problems
– Different Policies for Different Systems.
Unfortunately not all systems apply the same password policies in respect of length or complexity. While this can make it difficult to keep track of passwords, you should always apply the strongest password possible.
– Short and Complex or Long and Memorable?
There is some debate over the best structure for passwords. Some say short, complex passwords that do not contain words are preferable.
However it can be argued that using memorable passwords such as a phrase or song lyric make much longer passwords easier to remember.
Attacks
– Dictionary
A dictionary attack uses a file containing a list of words that can be found in the dictionary. It also tries combinations of words, so think carefully before using a common phrase as a password.
– Brute Force
Similar to a dictionary attack, however a brute force attack uses a methodical approach to work through all possible combinations i.e. aaa1, aaa2, aaa3, […] aab1, aab2, aab3 etc.
– Phishing
A phishing attack attempts to trick the user in to thinking they are responding to a legitimate email or form. Often targeting bank customers, when users click they are taken to a decoy site that harvests any information they enter.
– Social Engineering
Perhaps the most difficult to detect, social engineering is when real people attempt to obtain confidential information from someone – sometimes posing as someone of authority for example an IT support technician. Read about: Social Engineering Testing.
Summary
There is not way to 100% guarantee that your user accounts won’t be accessed, but by being mindful and vigilant of the possible attacks, you can reduce the risk.
