This year you’ll see a big push from us IT folks to have everyone do some firming up on password security. It’s a multi-part push focusing on several aspects; our net desire is to help increase our overall security and make your life easier (yes, you read that right).

Username plus password equals you.
From a technology perspective the way that we identify you as you is by a unique combination of your username and your password. Any actions carried out by your network account is tantamount to you carrying out the action; therefore there are a couple of simple steps that are essential for every employee to follow:
1. Do not share your username and password with anyone (up to and including MIS).
2. When you are logged into a computer or any of our network services do not let anyone use the computer.
3. If you are not at the computer log off or lock it.

Okay, I promise not to give out my password to anyone and I will not let anyone use my account. I’m safe now right?
Committing to these things are a fantastic start and before I go any further I want to congratulate you for taking this to heart. Really, pat yourself on the back before you read further.

Okay now that we’ve covered the basics in comes the “bad guy”; this bad guy has the intention of doing damage to company systems and/or soiling your good name by doing something bad while pretending to be you (i.e. surfing for porn).

The bad guy performs a brute force crack against your password (that’s computer speak for having a program make thousands of guesses a second trying to figure out what your password is). If your password is weak he’s able to gain access to your account within minutes. This isn’t a worse-case scenario; it’s something that happens very frequently.

But you said “weak password”, so there is such a thing as a “strong password”?
Absolutely. Passwords can be created so that they are very hard to break by following some simple rules:
1. Use longer passwords
2. Use a mixture of character types (upper and lower case letters, numbers and punctuation)

In comes the challenge.
As passwords get longer and more complicated they get harder to remember. So how do you make passwords that are both strong as well as easy to remember? Passphrases!

Passphrases are passwords that contain information and are formatted in a way that are easy for you to remember. For example, consider the password "Makeit20@password.com". This password utilizes upper and lower-case letters, two numbers, and two symbols. The password is 20 characters long and can be memorized with very little effort; perhaps even by the time you finish this article. Moreover, this password can be typed very fast. The portion "Makeit20" alternates between left and right-handed keys on the keyboard, improving speed, decreasing typos, and decreasing the chances of someone being able to discover your password by watching you.

What are some strategies for choosing a good password/passphrase?

Use lines from a childhood verse:
Verse Line: Yankee Doodle went to town
Password: YankDwto#t0wn

Expressions inspired by the name of a city:
City Expression: I love Paris in the springtime
Password: IL0vepint*ST

City Expression: Chicago is my kind of town
Password: Cim_Y_K0t

Foods disliked during childhood:
Food: rice and raisin pudding
Password: ricNr4iPudng

Food: boiled broccoli
Password: bo1%Brocc

Transformation techniques:
Technique: Transliteration
Illustrative Expression: photographic
Password: foTOgrafik

Technique: Interweaving of characters in successive words
Illustrative Expression: iron horse
Password: 1hrOrnSe!

Technique: Interweaving of characters in successive words
Illustrative Expression: file drawer
Password: FdirL4wer

Technique: Substitution of synonyms
Illustrative Expression: coffee break
Password: jaVa*rest

Technique: Substitution of antonyms
Illustrative Expression: stoplight
Password: starTdark

Note: Obviously, you shouldn't use any of the passwords used as examples in this article. Treat these examples as guidelines only.

But I don’t have anything important on the computers; so this doesn’t matter for me right?
Unfortunately in the modern age of computers nobody is an island. With nearly all computer equipment interconnected on a massive world-wide network (a.k.a. “The Internet”) problems on one machine can create problems for others, or worse spread the problem.

You’ve probably seen reports in the news recently of Viruses spreading over the internet. This type of thing is quite commonplace and will only continue to be that way until everyone realizes that security does matter for them.

But I digress, back to the topic at hand…

So you said you were going to make things easier for us, how?
One of the biggest pain points is that passwords have to be constantly changed; a big part of the reason that passwords need to be changed frequently is because of how easy it is to break “poor quality” passwords.

Our plan moving forward is to do a couple of things. First increase password security company-wide through the use of education (like you reading this article) as well as by technical means (forcing you to use stronger passwords by requiring them to be longer) and finally when the password security has been raised reducing the frequency by which passwords must be changed.

In addition we are considering/evaluating technologies that will allow us to integrate usernames/passwords between our systems so that you have less to remember (i.e. using the same username/password for our business system as you do on the network).