Creating a Secure Password - EiS Kent

IT Security
Creating a Secure
Password
Best Practise for Staff
Updated for
2013
The role that passwords play in securing a network
and its data can often be underestimated and
overlooked. Passwords provide the first line of
defence against unauthorized access.
Creating a strong password
‘Weak’ passwords can provide unauthorised users with
easy access to the network and your files, while strong
or complex passwords are considerably harder to
crack, even with the password-cracking software that is
available today. Password-cracking tools continue to
improve, and the computers used to crack passwords
are more powerful than ever. Password-cracking
software often uses one of three approaches:
l
l
l
Intelligent guessing
Dictionary attacks
Brute-force automated attacks that try every possible
combination of characters
Given enough time, the automated method can crack
any password. However, strong passwords are much
harder and therefore, take more time to crack than weak
passwords. A secure network has strong passwords for
all user accounts.
A weak password:
l Is no password at all
l Contains your user name, real name, company name
or any personal information
l Contains a complete dictionary word. For example,
Password is a weak password
A strong password:
l Is at least eight characters long
l Does not contain your user name, real name,
company name or any personal information
l Does not contain a complete dictionary word
l Is significantly different from previous passwords.
Passwords that increment (Password1, Password2,
Password3 ...) are not strong
l Is alphanumeric (contains both letters, numbers and
symbols)
A password can meet most of the criteria to be a strong
password but can still be rather weak. For example,
Hello2U! is a relatively weak password even though it
meets most of the criteria for a strong password.
H!elZl2o is a strong password because the dictionary
word is interspersed with symbols, numbers and other
letters.
Creating and remembering a strong password may
seem daunting at first, however, there are several
methods that can make creating and remembering a
strong password easier.
e.g. The first letters of an easy to remember sentence or
phrase can be used to form a password:
“I have a rabbit called Dennis who likes to eat carrots”
The password would then be: Iharcdwltec
This is much easier to remember and type because you
can think of the sentence as you type. Although the
password meets some of the strong password criteria, it
still lacks numeric, characters and a mixture of upper
and lower case letters. These can be added into the
password very easily.

IT Security – Creating a Secure Password 2
The Rabbits name in a normal sentence should be
capitalised, so this could be included in the password.
The word “to” could also be replaced with the number 2
and an exclamation mark at the end just for fun.
The password after these additions would then be:
iharcDwl2ec!
This is now a strong password that is easy to remember
and type.
Keeping your password strong
The most secure passwords in the world can also
become the most insecure passwords if they are not
“maintained”. Following the guidance below will help to
ensure your password is not compromised.
l
l
A password that is written down anywhere is not
secure, if you have to write a password down to
remember it then it is not suitable – create a new one.
Try to avoid using the same password for everything
as this makes several accounts vulnerable if one is
“hacked”, imagine if your car key also unlocked your
house.
l
l
l
l
l
l
Avoid using the save password option in applications
or browsers. DO NOT write a password on sticky
notes, desk blotters, calendars, or store it online
where it can be accessed by others.
Do not use any part of your name; first, middle or last!
Definitely do not use names of your children or pets.
Do not use other information easily obtained about
you. This includes pet names, car license plate
numbers, telephone numbers, identification numbers,
important dates, the make of your car, the name of the
street you live on and so on. Such passwords are very
easily guessed by someone who knows the user.
Do not use keyboard sequences, e.g., qwerty.
Do not use the original password given out when your
account was set up.
Do not share your password with others, no matter
what the circumstances are and DO NOT let anyone
use your account or use that of others.
l
l
All passwords should be changed regularly, in certain
circumstances more often. For example, if you
frequently use un-trusted devices or networks, your
password should be changed more frequently to
avoid the possibility of the password being captured
on a key logger etc , or if you work around children
with prying eyes.
Learn to type your password quickly so it’s harder for
others to see what keys are being pressed.
Our passion in EiS Kent is
to make a real difference
in education and
ultimately children's lives
by providing innovative
solutions and outstanding
support services.
www.eiskent.co.uk
info@eis.kent.gov.uk
Tel: 0300 065 8800
Fax: 01622 663591
EiS Kent
The Shepway Centre
Oxford Road
Maidstone, Kent
ME15 8AW