In-depth

Building a better password

Is your password really as secure as you think it is? Davey Winder investigates.

So you think you know what a secure password is? Think again. No, seriously. The chances are that the hackers are way ahead of you in terms of truly understanding secure password construction, and more importantly password deconstruction methods as well.

Brute forcing tools abound, which use both dictionary and hybrid dictionary methods to break the kind of password that many think are impervious to such automated breakage. Simply not using dictionary words is no longer protection enough, hackers can crack substitutions such as P455w0rd! instead of password in a matter of minutes. So what does constitute a secure password these days then?

Secure password construction

Current thinking dictates that a secure password needs to be not just eight characters in length anymore, but at least 12. Current thinking also dictates that in order for an enterprise to successfully implement a secure password solution it must consider three parameters: the level of security, the cost implication and user-friendliness.

The last of these is often overlooked, and that's a big mistake as Jan Valcke, president and chief operating officer (COO) at VASCO Data Security, reminds us that "attention must be paid to ensure that extreme password complexity rules don't break the overall security of the scheme because users start writing down passwords".

But how can you build complex passwords that are at least 12 characters long, include special characters and are not dictionary words, without breaking that user friendly rule?

Rik Ferguson, senior security advisor at Trend Micro, suggests you think of a memorable phrase such as "Motley Crue and Adam and the Ants were the soundtrack of my youth" and then take the initial letters to form MCAAATAWTSOMY. "This will be the basis of the password" Ferguson advises "but we need to make sure to a mix of upper and lower case characters, numbers and special characters".

So mixing cases gives us McaAatAwTsomY, changing the o to an 0 produces McaAatAwTs0mY and finally the special characters are introduced by changing the first 'and' into + and the second to & which gives us Mc+A&tAwTs0mY. Ferguson recommends using the symbol as it's overlooked by many brute force tools, so the final password would be: Mc+A&tAwTs0mY

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Most Popular

SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

12 Jan 2021