Passwords

Let's talk about passwords. Now, I've seen some really bad passwords in the past, and I've seen them out of novice people, those who don't really know any better and so they don't know how to implement good password behaviors out there and how to manage passwords, through to the people that are more advanced, but they're operating off of old guidelines. The guidelines for passwords have changed, and you need to be up to speed on passwords.

In fact, I've seen even banks and financial institutions, institutions that need to be the most secure, but they'll institute certain processes and policies with their passwords that really don't encourage good password management.

How passwords are hacked

To understand what makes a good password, it is helpful to know how passwords are hacked.

So how do hackers hack passwords? Well, there's really two different methods. Number one, there is stealing: they'll somehow grab the credentials and they know for sure what the credentials are. Or another way is that they just start guessing at it, and there's some mechanisms that can help them take educated guesses on what could possibly be passwords.

So when somebody steals something, perhaps it's with a phishing technique. They send an email out that looks legitimate. Maybe it looks like it's from your bank. You click on a link. You look like you're signing into your bank, and now the hacker has grabbed the credentials.

Or maybe they're eavesdropping. Somehow they're listening into the conversation, and you type in your password and then it sends that password across and they are listening into that conversation.

Or there's a man in the middle, that they have redirected your traffic to another third party, to another device that's collecting the information and that is the go-between between you and whatever the end destination is.

Or perhaps it's a key logger, which is a program that gets installed on your machine, and then every keystroke you do on that machine gets recorded and sent back to the hacker, and when that happens then they look in there for passwords.

Guessing

If they're guessing, there's a couple ways that they can be guessing, and that's through brute force. They do brute force, which means they're just trying a bunch of different passwords on your account. Or there's something called spraying, which is they have a password that's a common password and then they're just using a bunch of user accounts with that common password. So brute force is they have a user account they're trying to hack and they're trying a bunch of different passwords. The other one, the spraying, is they're trying a password on a lot of different accounts, just by guessing passwords.

Hackers can be very successful at breaking into accounts, and there are some ways that they use different tools to be able to take an educated guess on what your password could be.

First of all, there is this brute force where they'll just try everything. They'll start out with A, B, C, D, and keep repeating it with one character, two characters, three characters, four characters, and so on and so forth. And they'll just keep trying stuff until they get into your account.

Another way that they'll do it is they'll have a whole bunch of common passwords that are out there and they'll just try those common passwords. And so that's another method in which they would do it.

Sometimes they'll just take dictionary words, a list of dictionary words, and then they'll try that against your account as well.

They'll look in and start researching more about you and your identity, and they'll start taking information about your identity such as your name, any usernames that are known, any birth dates that you have, any addresses that you had, your work address that you have, the work name that you have, any information they can gather online about you. And they can find out a lot of information about you, then they can use that. And then they'll also use any ancestors, or any information of people that you know, or any information about people in your household. They'll also use that to mix and match different pieces of information to try to hack the system. And what they'll do is they can just line these up and test one right after another. It's just a computer program that just tests, and they can just test one right after another.

Then we have credential stuffing. Credential stuffing is when a hacker has some sort of hacked information from you, a username and password in one system, and tries it on the system that it's trying to hack. So maybe it has hacked some sort of social media account of yours, and now it's trying to hack your bank account with that same information. So that's credential stuffing.

One of the ways that this is done is, whenever somebody gets compromised out there, that information is out there, and you can go download databases of usernames and passwords. And most likely, if you used any kind of social media or any kind of accounts out there, most likely something has been hacked out there and your username and password for one of those accounts is out there. And they have a list with millions and millions and millions of these records that you most likely show up in, full of these usernames and passwords that people have used in the past. And then they'll just take that list of usernames and passwords and try it out against different accounts. So if you ever reuse a password, then there's a chance that they have that password and can crack into your system based off of those other systems that have been hacked in the past.

Then there's also the use of rainbow tables. Rainbow tables is a way to look up passwords. What typically happens with a system, or should happen with a system, is it doesn't store your password in clear text; it does some sort of encryption, or what's called a hash, to make it so that way your password is unrecognizable. What a rainbow table does is it's a lookup table, so that way you can take whatever that hash or that encryption is and you can reverse engineer it to find out what your password is. So rainbow tables can be used, if there are hacked passwords that have been encrypted, to essentially unencrypt that information so it can be used against your account.

So here are some ways that hackers will use to hack your system, or brute force attack and guess what credentials you're using to get into the system.

What makes a good password

So what makes a good password, and how do you do good password management? Let's talk about a few different ways that you can lessen your risk of getting hacked.

First of all, you use MFA. This is one of the single most important things that you can do to secure your accounts. If there's an MFA option, use it, because it can really save you a lot of time and headache. MFA is multifactor authentication, and we're going to get more into it later on. But for now, just know that an example of this would be, as you're getting onto a system, maybe it sends you a text message with a number, and then that verifies that you in fact have the phone; by typing in this number into the account, it verifies that you have the phone. So not only is it asking for a username and password to get into it, but you also have to have the phone. And a hacker is most likely not going to have your phone to get into the account. So it really does a huge amount to securing your account and making sure somebody can't use your account. This is so effective, in fact, that cybersecurity insurance is really requiring that you have MFA in order to get certain levels of cybersecurity insurance, because it is so effective and so important.

The next thing that I'd add on here, in the order of importance, is lots of characters. Every time you add an additional character, the chances of somebody guessing that password or cracking the password becomes exponentially larger. So every time you add just one character, it gets much more difficult, by a power of magnitude more difficult, to be able to crack that password. And so length is huge. Length is very important. The old recommendation, and you still see this, was eight characters. It's just not enough. The new one says 12 plus. On the networks that I manage, I say at least 16 characters, because it's so critical to have a lengthy password.

The next one on this list is not quite as important, and that's complexity. Out of the two, between the length of the password and complexity, the length is much more important. And some of the old recommendations for complexity just make it difficult for you to manage the passwords. So I use this one sparingly, but complexity does alter things enough where it does add an extra sense of security. So I don't want to leave it off the list, because it can definitely improve a password. I just don't want to overemphasize it too much, because I really feel like the complexity one is abused quite a bit. But you can use capital letters, lowercase letters, numbers and special characters; those are the things that will create complexity. And you see this quite often, where, well, you have to have at least one uppercase and one lowercase and one number. So you're forcing the users to have some sort of complexity to their password.

The next one is one password per account. And I've seen this happen before, where a password gets hacked because they are using the same password for every single account. It gets compromised in one account, maybe a social media account, and now their bank account's compromised. So don't do this. You need to make sure that you have a different password for every account that you use. And obviously this starts becoming difficult to be able to start remembering all of these passwords, but we'll talk about that here in a bit.

The next thing to do, and I think this one is also used wrong, is change often. Change your passwords often. This does increase the security of your accounts. And the idea behind this is, if something were to be compromised out there, then the compromised account is only compromised to the point where you change that account, and then it's no longer compromised. And so this does help. Although this is another one that is overused, and in fact we'll talk about this when we get further into this, but I don't make my users change their passwords, and I'll explain why later on.

The next thing here is secure transmit and storage of passwords. Make sure as a system administrator you are securing those passwords. So like on Cisco equipment, there's a way to make all of those passwords encrypted on there. If it's being transmitted, make sure you're transmitting in a secure method. Don't use something like Telnet to get into a machine; use something like SSH that has encryption, so that people can't capture those passwords as it's being sent clear text. So make sure you secure both the transmit and storage: it's encrypting in transit and at rest.

So make sure that you're doing at least some of these. Like I say, some of these get abused a little bit, and we're going to talk a little bit more about that here in a bit.

Things to avoid

There are definitely things to avoid.

• Avoid any kind of repetition, like a letter that's repeating multiple times, or any kind of sequences, ABC, one two three.
• Avoid any kind of patterns, A1 B2 C3. Or some people hit the keyboard and ASDF, or they'll do some sort of pattern on their keyboard. Avoid doing that.
• Avoid any dictionary words. And we'll see maybe an exception to this a little later, but generally speaking, just a dictionary word, just a single dictionary word, is not going to do it. And even two dictionary words is not going to do it either. You need multiple dictionary words if you're going to use that method.
• Avoid common phrases or quotes, like Singing in the Rain. Avoid things that are common out there and would show up on a Google search.
• Avoid any kind of personal information: names, usernames, dates, addresses. This is personal information for you and for anybody who's related to you, anybody that you know. Anything that is known to the public you need to avoid using, because people can find out a lot of information about you, load it up into a program, and that program then can just try those passwords until it gets the right password. So avoid using any of that personal information.

Also, avoid bad password management. This would be things like writing things down. This would be things like writing a sequence. So a lot of times within your different systems, it requires you to change your password. What do most users do? Almost all of the users will type in password one, and then the next time it'll be password two, and the next time it'll be password three. So really, is this secure at all? I mean, if I know a couple of the passwords that you've used before, password one and two, I know the next one's going to be password three, or I can try password four, password five.

And this is one of the reasons why I don't make my users change their passwords often. So even though that is a good security practice, to change your passwords often, if you make your users change their passwords often, what they end up having to do is either having to write it down and put it on a sticky out there for everybody to see, or they do sequences like this.

Once again, avoid using the same password on multiple accounts. You must use different passwords on each of the accounts. And don't just avoid reusing, flat out don't reuse any old passwords. They need to be unique passwords every time.

And then of course, don't share with anyone else. If it's your personal account, don't share it with anyone else. If it is a shared account that you need to share credentials with somebody else, that's where, when you're sending credentials to somebody else, make sure you do it in a secure manner. But for the most part, you shouldn't really be sharing any credentials with other people.

Some of the recommendations that I've seen in the past are things like substitution. You put an at symbol for the A. You put dollar signs for the S. You put a zero for the O. This is well known out there. It's really not that effective. So you'll see this on recommendation sites, that these are good password management, but really I don't think it is at all. I think that substitutions don't really work out all that well, and it makes you really have to remember those passwords, makes it difficult to remember. So I don't think that this is really a good solution.

Another thing is, I've seen sites that recommend misspellings, and same thing, there's common misspellings out there and the hackers know this already. The hackers will load up, they're not going to just try the word password, they're going to try the word password with the at sign in it, they're going to try the word password with one dollar sign in it, with two dollar signs, with a zero. They're going to try every single combination, because once again, they just load this up into a computer and it's just testing. So it doesn't really take them much more effort to test these different mechanisms out.

Password managers

So what makes a good password example? Well, there it is on the screen. This is what I'm recommending, is you have passwords like this, which is crazy. How do you remember that? Well, you can't remember that. There's not a good way to remember this. And you have to remember this for each one. Maybe this is my bank account, maybe this is my admin account at work, maybe this is a social media account. It's not really that great.

So how do we instill upon people to use good passwords on systems, and comply with good password management, yet be able to remember all of this?

I do have big long complex passwords that I use, and I use a different one for every single one of the accounts that I have. But I use a password manager. A password manager is a way that you can track, in a secure way, track your passwords. And there are services out there that will allow you to do this, and there's free programs that are out there that will allow you to do this. I use KeePass because it's stored on my local machine. There are some services out there that can make it really easy to manage all of this. There's a little bit of concern, because you are passing your credentials over to somebody else, so there's a concern with that. There's also a concern with the way I have it, because if I lose my password manager file, then I've lost my passwords. So there are some concerns about this. It's not completely, you're free and there's no risk whatsoever. But it does allow you to secure your accounts, and I've used it for years now and it works great. So I highly recommend using a password manager.

The idea behind this is that it is storing my passwords in a secure manner, and then I just need one password that I remember to get into it, and that's where you can use a password phrase. I got this one from the movie Home, where O has his big long password that he uses, which is kind of crazy. But this is something that you can use: create your own password phrase that's unique to you that no one else would be able to guess, and that would work really well to get into your password manager. And then all your passwords within your password manager are encrypted, that you can use to get into your different accounts.

So I highly recommend using a password manager. If you're part of a business, then I recommend providing your users with a password manager and then educating them on how to use that password manager, because it is definitely a safer way to keep track of all your accounts, and they don't have to remember every single account and how to get into every single account.

The XKCD cartoon

This is a good cartoon that really sums it up. This is from XKCD, and it's a cartoon that I use a lot when explaining what makes a good password and how you can create a good password.

In the upper three blocks that it has here, what it's showing you is the way that we've trained people to use passwords. So here it's using eight characters, it's using common substitutions, and so this is a password. And what it's saying is that a computer can easily guess this password. So it shows right here, it says how long it takes a computer to guess what the password is, and in this case right here it's saying 3 days for a computer to guess this password right here. And it's also saying for a user to remember this password is very difficult to use.

So its methodology for explaining what creates a good password, one that a user can remember but it's hard for a computer to hack, would be to take four random words and put them in some sort of random order. And so what it's showing you here is correct horse battery staple. And you can create a way to memorize it; it's showing here in this last frame right here, to remember it: that's a battery staple, correct. And so that's how you would remember this phrase that it has, correct horse battery staple.

But with putting these four random words that are fairly easy to remember, putting them together, it would take a computer 550 years to be able to guess this password right here. And it's using common dictionary words, but it's just using four of them that would not really fall together, would have no correlation with each other. And so there are ways that you can create really good passwords without going through all this crazy complexity, and still be able to remember it, but not really have this password be guessable.

Password enforcement

In this career you're going to be in charge of setting the precedent, or setting the policies, or setting up the systems that are going to require certain things of your users. And so there are some password enforcement policies that you should follow as you are forcing your users to manage their passwords and what their passwords must be.

As I mentioned before, MFA is extremely important. So if you have the chance to implement MFA, do it, and require your users to do it as well.

Once again, require your users to come up with a long password. This is important. I require my users to come up with a 16 character password, because the length really makes a big difference with this.

Also, consider what happens if they exceed a number of attempts, because a lot of these techniques that they use to hack into your system require a program to test out all of these different passwords and all these different sets of credentials. So have something that once they've reached a threshold, maybe within a five minute period, if there's a certain amount that they've tested the account, or maybe they've tried five different passwords and it's failed, then it locks them out for a minute or five minutes or 20 minutes or something to that effect. So some sort of lockout period, max number of attempts, and that will help make sure that hackers are not able to use their tools to hack into a system.

Screen the passwords. You can go and download that database of all the hacked usernames and passwords, and you can run it against your accounts, against Active Directory, against your different systems, and see if people are still reusing some of those same passwords or some of the same common passwords. I've found that, yes, in fact, we've done this before, and yes, in fact, people are using the same passwords, and they're using simple passwords, and you've got to make them change the password. Some users have to do a few attempts before they get it right.

I would not recommend you making your users change their passwords often. It's something that you can tell them, hey, this is a good practice to have, is to change your passwords, but don't force them to do it, because they're either going to do that sequential count up, 1 2 3 4, and put that at the end of whatever password they have, which is really not going to be all that much more secure, or they're going to write it down, because you're requiring long passwords and perhaps you're requiring some sort of complexity. And so now you're asking them to have this big long complex password and you have to change it every single 90 days or every 180 days. So the industry has now said don't make your users change their passwords, unless there's a reason to change it. If there's a compromised account, or you suspect something, or maybe you suspect some sort of malware on their equipment, then at that point in time you can make them change it. But don't do it on a regular interval.

And then, if you're creating a system, allow copy and paste. Because without the copy and paste, I run across times when there are some systems that don't allow copy and paste, and I can't copy and paste from my password manager. Well, that means I have to type it out. That means that I'm going to go back and, rather than my big long complex password, I'm going to simplify that password so I can actually type it into the system. And then now I'm actually less secure on your system, because you've forced me to not allow copy and paste.

And there's a few other things I've run into. I've run into a bank before that only had a max number of characters of 16 characters, which is ridiculous. Like, all my bank accounts are way more than 16 characters. And I've run into some other kind of silly behaviors as well. So make sure that you do a little bit of research if you're implementing a new system, about different password policies that you can use, and that you are taking a logical approach to this.

And I've even had some other vendors or some partners that come back and say, are you doing all of this? And I've had to respond back to them and say, no, we're not doing exactly what you're saying, because you're using outdated guidelines. Improve your guidelines so that way it matches what the industry standard is doing. And it will change over time, and even when you're listening to this, things may have shifted and there might be new recommendations, because they found that certain things are working and certain things aren't working. So make sure that you are up to date on your password guidelines and what makes a good password.

Multifactor authentication

Let's get into MFA, because this is one of the single most important mechanisms you can do to really secure your networks, really secure your accounts.

Just having a username and password out there, you will most likely have some of your accounts hacked. If you have a bunch of users out there and you're just requiring them to have a username and password, most likely at some point in time somebody's going to get hacked and they're going to be into your system. So once you implement MFA, it puts that barrier so much higher, just amazingly so much higher, because now not only do they have to know the password, but they have to have some other mechanism in order to get into there.

So the idea behind MFA is that you have at least two, maybe multiple, forms of identifying who you are. And ways of doing that is something you know, like a password, something you have, and something you are. So: know, have, is. Something you know, something you have, something that you are.

An example of something you know could be a password, a PIN, a secret word. Something that the user has could be a badge, could be a token, could be an authenticator app, could be an SMS message, so like a phone and you get SMS messages, maybe some sort of certificate. So really, it's something that you physically have, whether it be your phone or another device. There's little key fobs that you can press and it will come up with a code. So there's different authenticators that are out there, but you can have your users use those authenticators.

So this is what I commonly use together: I use some sort of SMS messaging or authenticator app that comes up with a code that they have to enter into the system along with their password to get in. And this together is great.

There is also something that they are; these are also biometrics. So this is like using a fingerprint. So you can use things like fingerprints, palm prints, a voice, retina scan, signature, DNA. Those type of things would fall in this third category right here.

Passwords is such an important topic, and what I found is commonly misunderstood. People are commonly misusing passwords, and they put out there policies that seem like they're secure policies, but they're not. They're really not. The password guidelines have changed, and you need to keep up on it.