In-depth

Building a better password

Is your password really as secure as you think it is? Davey Winder investigates.

So you think you know what a secure password is? Think again. No, seriously. The chances are that the hackers are way ahead of you in terms of truly understanding secure password construction, and more importantly password deconstruction methods as well.

Brute forcing tools abound, which use both dictionary and hybrid dictionary methods to break the kind of password that many think are impervious to such automated breakage. Simply not using dictionary words is no longer protection enough, hackers can crack substitutions such as P455w0rd! instead of password in a matter of minutes. So what does constitute a secure password these days then?

Advertisement - Article continues below

Secure password construction

Current thinking dictates that a secure password needs to be not just eight characters in length anymore, but at least 12. Current thinking also dictates that in order for an enterprise to successfully implement a secure password solution it must consider three parameters: the level of security, the cost implication and user-friendliness.

The last of these is often overlooked, and that's a big mistake as Jan Valcke, president and chief operating officer (COO) at VASCO Data Security, reminds us that "attention must be paid to ensure that extreme password complexity rules don't break the overall security of the scheme because users start writing down passwords".

Advertisement
Advertisement - Article continues below

But how can you build complex passwords that are at least 12 characters long, include special characters and are not dictionary words, without breaking that user friendly rule?

Rik Ferguson, senior security advisor at Trend Micro, suggests you think of a memorable phrase such as "Motley Crue and Adam and the Ants were the soundtrack of my youth" and then take the initial letters to form MCAAATAWTSOMY. "This will be the basis of the password" Ferguson advises "but we need to make sure to a mix of upper and lower case characters, numbers and special characters".

Advertisement - Article continues below

So mixing cases gives us McaAatAwTsomY, changing the o to an 0 produces McaAatAwTs0mY and finally the special characters are introduced by changing the first 'and' into + and the second to & which gives us Mc+A&tAwTs0mY. Ferguson recommends using the symbol as it's overlooked by many brute force tools, so the final password would be: Mc+A&tAwTs0mY

Featured Resources

Successful digital transformations are future ready - now

Research findings identify key ingredients to complete your transformation journey

Download now

Cyber security for accountants

3 ways to protect yourself and your clients online

Download now

The future of database administrators in the era of the autonomous database

Autonomous databases are here. So who needs database administrators anymore?

Download now

The IT expert’s guide to AI and content management

Your guide to the biggest opportunities for IT teams when it comes to AI and content management

Download now
Advertisement

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/server-storage/servers/355254/a-critical-flaw-in-350000-microsoft-exchange-remains-unpatched
servers

A critical flaw in 350,000 Microsoft Exchange remains unpatched

7 Apr 2020
Visit/business/business-strategy/355245/gchq-and-ncsc-alerted-over-imagination-technologies-chinese
Business strategy

GCHQ and NCSC alerted over Imagination Technologies Chinese takeover

7 Apr 2020