Building a better password

Is your password really as secure as you think it is? Davey Winder investigates.

In the end, what makes implementing a successful secure password management strategy is actually having a strategy in the first place insists Kevin Bocek, director at IronKey. "While it may seem simple" Bocek tells us "it's most important to have a password management strategy and policy of some sort that's actually implemented and enforced even though it's not perfect".

At the smaller end of the enterprise scale, this is often still not yet accomplished. But with the Information Commissioner's Office placing the spotlight on data breaches, many organisations of all sizes have started encrypting mobile data.

"Without being able to enforce and report on encryption use, including the type and quality of passwords used for unlocking encryption keys" Bocek warns "escaping a fine that can reach 500,000 could provide difficult".

Which is where a Continuous Controls Monitoring (CCM) solution can be useful, suggests Richard Hunt.

"CCM provides users with real-time status assurances for all of their compliance control points" he explains "a rule can be configured that triggers an automatic and regular review of password complexity to ensure that user passwords contain enough variation in terms of numbers and upper and lowercase letters". Any exceptions will be automatically flagged in the control output and then reviewed by the IT Admin for relevant action.

Secure or not secure?

So what makes a truly secure password? Jason Hart, an ex-ethical hacker and now vice president of security at CRYPTOCard has a very straight response to the question: nothing makes a password truly secure!

"Passwords are the softest security target" Hart warns "and until people and organisations start adopting strong authentication in the form of, for instance, two-factor authentication this problem won't go away".

Sadly, of course, he is right. Which is why many enterprises are now combining something you have (such as a smartcard or USB stick with a one time password function) with something you know (a PIN) to secure their networks instead.

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Recommended

Defense Dept. expands vulnerability disclosure program to all publicly accessible defense systems
ethical hacking

Defense Dept. expands vulnerability disclosure program to all publicly accessible defense systems

5 May 2021
Security researchers take control of a Tesla via drone
ethical hacking

Security researchers take control of a Tesla via drone

5 May 2021
Best free malware removal tools 2021
Security

Best free malware removal tools 2021

5 May 2021
Acuant acquires identity verification provider Hello Soda
mergers and acquisitions

Acuant acquires identity verification provider Hello Soda

4 May 2021

Most Popular

Dell patches vulnerability affecting hundreds of computer models worldwide
cyber security

Dell patches vulnerability affecting hundreds of computer models worldwide

5 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021