Let’s face it, everybody hates passwords. They are a pain and a nuisance, but in today’s connected world, they are clearly necessary. Passwords are multiplying and are not going away any time soon. Most companies have no real password requirement. Everyone has a password but the clarity on what needs to be done and what is appropriate and/or what’s not appropriate is not distributed to the company.
You need to take this seriously, securing your information is important.
“But Marge does not have anything really sensitive on her computer so we just leave her alone.” – Anonymous Owner
There is often a feeling that certain people need less security, because their work does not deal with sensitive information. Please understand leaving one person’s password unsecured is like leaving a door unlocked to your palace. You cannot make this assumption without paying high penalties.
All passwords need to be secure and updated. Often breaches start by entering a smaller target to gain access to the real target. We see hacks that use smaller companies who service larger organizations targeted because they tend to be very lacking in basic security.
So what is a secure or strong password?
It may sound cliché, but your password has to be strong or there is no point in it. There are plenty of articles and viewpoints out there about how complex passwords must be, but you should always have a minimum of at least eight characters. It should not be a dictionary word (in English or any other language). It should include both uppercase and lowercase letters and a special character or two. A passphrase is a great approach as well, as long as it is not common. Passwords like 123123, letmein, birthdays, sports, names, even password1 are no good. It is like having a key with no ridges.
NOTE: Stop writing your latest password on sticky notes and “hiding” them under your desk. That is a security 101 no-no. Store it somewhere safe, out of everyone’s hands.
The top passwords for this year:
1. 123456
2. password
3. 12345
4. 12345678
5. qwerty
6. 123456789
7. 1234
8. baseball
9. dragon
10. football
11. 1234567
12. monkey
13. letmein
14. abc123
15. 111111
16.mustang
17. access
18. shadow
19. master
20. michael
21. superman
22. 696969
23. 123123
24. batman
25. trustno1
Apparently lots of people enjoy playing baseball with a dragon and driving a superman mustang. Personally, we prefer the bat mobile.
Put your password to the test at this “How Secure Is My Password” website.
Your password policy:
Create – Implement – Enforce
Your WRITTEN policy needs to define secure and unsecured passwords, sharing rules, frequency of changing and reiterate the importance of them. All those that complain may not be fully educated on the impact that a breach would have on everyone, not just the company. Please explain to your staff clearly why it is a requirement of being employed. Lastly, your employees need to acknowledge they understand it and are responsible to abide by it. They need to also be accountable.
The skeleton of your policy should include:
Minimum password length
Password composition:
Character requirements and allowances as well as capitals, lowercase, numbers, special characters or items such as your name and the company name are not allowed.
Password age limitation:
Password storage:
Reuse of passwords:
Sharing and transferring:
Passwords are not allowed to be shared without proper authorization.
If it is shared, establish what criteria is needed to share.
Electronic transmission:
Requirements for System Administrators:
Enforcement:
Exemptions:
Now let’s be reasonable, you are not Fort Knox, but perspective still matters. If you have anything of value on those systems that you wouldn’t want distributed to everyone: your employees, competitors, vendors, partners, investors, ex-spouse, etc. then you need to protect it. Like your key to the lock on the front building that’s there for a reason.
But really, who is out to get me? I am just a small business owner.
Maybe you are the kindest person with no secrets willing to give away all your information. Even so, you may not realize largest offenders are most often internal or external IT people [who have the largest amount of access to your network]. They have access to your servers, workstations, applications and firewall. Make sure you have a process to verify their compliance as well. Also, be certain that many times these mistakes are simply that, mistakes. If one person unknowingly provides their password to an outsider who has any malicious intent, your biggest asset, and your information could be swiped from you in minutes. In this case you can be yourself, be trusting on other levels, but don’t be naive with your information.
Avoid Reaction, Take Action.
Create a written password policy. It should be part of your computer usage policy. Make sure all employees are familiar with it and agree to abide by it.
Help them understand why it is important. Listen to the groans, appreciate their issues and then insist they do it.
Help them understand what appropriate and inappropriate passwords are.
Make sure your IT support puts the policy in place that requires policy to be followed. Often they will not like this because they will have to spend more time “resetting passwords”. A small price to pay for security.
Make sure your IT people are following the same procedure. We have seen often they circumvent it, because they have the authority.
Written by Dan Adams, CEO of BBB Accredited Business, New England Network Solutions (NENS).
Dan is a serial entrepreneur who ran his first retail operation in high school. He founded NENS in 1993 and over the years, owned and managed several start-up companies. Dan is passionate about sharing his success strategies with fellow entrepreneurs.
That’s why Better Business Bureau Serving Eastern Massachusetts, Maine, Rhode Island and Vermont and Google have teamed up on Google’s latest program called Let’s Put Our Cities on the Map. Our mission: to help businesses in 30,000 cities get the help they need to succeed online, for free. Because stronger businesses mean stronger communities.
