Companies that utilize a public and/or a private Web site for information sharing are constantly under new security threats. And, the problem is getting worse due to automated tools that can distribute their infestations via botnets. In particular, many individuals and companies are seeing increasing attacks through social network sites because the audiences—at these social media sites—are more vulnerable and less knowledgeable on phishing and malware attacks.

As a result of these automated security threats, there has been an increase in password theft and cross-exposure where credentials for one application—like a social media account—are getting discovered and then utilized for access to banking, business, and more confidential types of accounts. So… what can companies do to help them be more secure?

It is especially important that organizations adhere to some kind of “best practice” for security. For example, the ISO 27002 document provides excellent recommendations for information security management best practices.  While this document covers many considerations, we believe that the password security policies section is a good place to start for employee password guidance. Below, please find a helpful checklist regarding the ISO 27002 recommendations and policies to share with your employees:

• Keep passwords confidential
• Avoid keeping a record (e.g. paper, software file or hand-held device) of passwords, unless this can be stored securely and the method of storing has been approved
• Change passwords whenever there is any indication of possible system or password compromise
• Select quality passwords with sufficient minimum length (typically 8 characters or greater) which are:
  • Easy to remember
  • Not based on anything somebody else could easily guess or obtain using person related information, e.g. names, telephone numbers, and dates of birth etc.
  • Not vulnerable to dictionary attacks (i.e. do not consist of words included in dictionaries)
  • Free of consecutive identical, all-numeric or all-alphabetic characters
• Change passwords at regular intervals or based on the number of accesses (passwords for privileged accounts should be changed more frequently than normal passwords), and avoid re-using or cycling old passwords
• Change temporary passwords at the first log-on
• Not include passwords in any automated log-on process, e.g. stored in a macro or function key
• Not share individual user passwords
• Not use the same password for business and non-business purposes
• If users need to access multiple services, systems or platforms, and are required to maintain multiple separate passwords, they should be advised that they may use a single, quality password (see d) above) for all services where the user is assured that a reasonable level of protection has been established for the storage of the password within each service, system or platform
• Management of the help desk system dealing with lost or forgotten passwords needs special care as this may also be a means of attack to the password system (by fictitious callers, data hacking, etc.)
• Make sure that any authentication attempt is being made though a legitimate logon screen utilizing an encrypted connection (i.e. SSL, etc.)

While many of these recommendations may seem obvious, I am quite certain that most users reading this blog have either violated one of these best practices and/or know someone who has… 

Organizations actively seeking to tighten security can start by reinforcing the password policy checklist identified above and reminding personnel periodically about the importance of basic password security measures.