{"id":6338,"date":"2021-09-08T06:44:47","date_gmt":"2021-09-08T06:44:47","guid":{"rendered":"https:\/\/www.insentragroup.com\/gb02\/?p=6338"},"modified":"2021-09-08T06:44:50","modified_gmt":"2021-09-08T06:44:50","slug":"pass-the-passwords-to-the-left-hand-side","status":"publish","type":"post","link":"https:\/\/www.insentragroup.com\/gb\/insights\/geek-speak\/secure-workplace\/pass-the-passwords-to-the-left-hand-side\/","title":{"rendered":"Pass the Passwords to the Left-Hand Side"},"content":{"rendered":"\n<p>Passwords and codes have been a mainstay of security since the dawn of time. Codes to allow you entry to the castle, to prove which side you\u2019re fighting for, to establish membership of your gang at school or to exchange messages with your first loves.&nbsp; Aah.&nbsp; In the modern era, they\u2019ve come to be used to protect access to everything from your take-away account to your fitness tracker, your email, and your money.&nbsp;<\/p>\n\n\n\n<p>Now, before you all cry out: there are undoubtedly modern improvements for strong authentication \u2013 multi-factor authentication, biometrics, one-time passwords and password-less access can all reduce the risk of a malicious actor finding a static password and gaining access to your systems \u2013 and these should be implemented \u2013 however, passwords are NOT going away just yet in many cases.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">SO, WHAT DO WE DO?<\/h3>\n\n\n\n<p>The big problem is we\u2019re human; we like things to be simple and, we have picked up some misguided ideas about the protection we think we need.<\/p>\n\n\n\n<p>Here are a few common thought processes:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>\u201cOnly I know all my family\u2019s birthdays \/house numbers \/middle names \/ pets names \/first schools \/honeymoon destination\u201d. No, Facebook knows; better assume everyone knows.<\/li><li>\u201cIt looks complex to me\u201d or \u201cWhat? It\u2019s different from last time\u2026\u201d No, the computer doesn\u2019t care if you substitute letters for numbers \u2013 in fact, it doesn\u2019t care whether your password has any meaning at all. It is going to rattle through 100 million combinations a second \u2013 just like you did when you cracked into your brother\u2019s three-digit combination lock as a kid, only a lot, lot, lot faster!<\/li><li>\u201cThis system doesn\u2019t have anything important in it anyway\u201d or \u201cI don\u2019t care if someone cracks it: I just want to order my pizza.\u201d<\/li><\/ul>\n\n\n\n<p>It&#8217;s funny, but there&#8217;s an important point here: we have too many passwords \u2013 we&#8217;re asked to create them for almost everything, leading to one of the biggest problems; theme and variation.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>In addition, there has been accepted wisdom around password policies which unfortunately, have led to some of these behaviours above. For example:<\/li><li>\u201cI\u2019ll just add 1 to the number I used last.&nbsp; If only I could remember which number I\u2019d got to \u2013 maybe I\u2019ll use the year or something&#8230;\u201d&nbsp; What we\u2019re effectively doing here is introducing a repeatable pattern into the password format; very similar to adding just one letter to the alphabet \u2013 but the killer blow is this effectively reduces the length of your password by the length of your pattern.&nbsp;<\/li><li>If you have an eight-character password with seven digits repeated from last time, your new password&#8217;s effective ength is 2!! You may as well publish it on Twitter.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>\u201cRecognisable words are bad. Adding letters and numbers makes them stronger.\u201d&nbsp; See above.&nbsp; Computers don\u2019t care what characters you use \u2013 it\u2019s all the same to them.&nbsp; What computers do care about is how long the password is \u2013 and this is crucial.&nbsp; We\u2019ll explore this further below.<\/li><li>\u201cHaving lots of passwords you can remember is better than having a few (good ones).\u201d And \u201cDon\u2019t save your passwords.\u201d.&nbsp; This is a double whammy because the big problem here is a human one:&nbsp; we don\u2019t remember good passwords; we remember patterns.&nbsp; If we force people to maintain many passwords, naturally they\u2019re going to use repeating patterns to remember or write them down.&nbsp; By writing them down we\u2026 you see the problem?<\/li><\/ul>\n\n\n\n<p>So, much of the received wisdom about passwords quickly fall under scrutiny as you can see.&nbsp; In reality, only a few things make any difference:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Size matters&nbsp;<\/strong>\u2013 the longer the password, the better. I\u2019ll leave you to do the maths but even if we&nbsp;<em>only<\/em>&nbsp;think of using 52 (upper and lower case) characters in the English alphabet, then going from 8 characters to 10 characters in your password increases the strength by 1,000 times. Adding another two characters (12) is literally&nbsp;<strong>a million times&nbsp;<\/strong>better than an 8-character password.&nbsp; By contrast, adding complex characters (20 numbers and symbols) increases the strength of an 8-character password by only 13 times.<\/li><li><strong>Don\u2019t use common patterns or metadata<\/strong>&nbsp;\u2013 if you use common terms in your passwords -(however long they are) then you may as well think of each of these terms as simply representing one single letter. This reduces the effective length of the password and does not significantly increase the strength.<\/li><li><strong>Uniqueness<\/strong>&nbsp;<strong>matters<\/strong>&nbsp;\u2013 for even more reasons, as we\u2019ll see below.<\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">HOW MANY?<\/h3>\n\n\n\n<p>One thing we have not addressed is the proliferation of passwords. They\u2019re everywhere and this makes us lazy.&nbsp; We do not ascribe as much importance to our takeaway ordering service as we do to our bank, but research says we&#8217;re likely to use the same password.&nbsp; And while the bank may use additional authentication mechanisms to reinforce your password, the takeaway likely will not.<\/p>\n\n\n\n<p>So, what can we do to reduce this risk?&nbsp; Research says there are two things:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Using unified authentication mechanisms&nbsp;<\/strong>\u2013 using a robust login mechanism across multiple services means you do not need so many passwords and, if you do need to change the password, you do it only once. So, if you\u2019re offered authentication using an existing authentication service, and you trust it, then use it.<\/li><li><strong>Use a password manager<\/strong>&nbsp;&#8211; you may say: \u201cbut isn\u2019t this just as bad as writing them down?\u201d. The answer is no. A good password manager can:<\/li><\/ol>\n\n\n\n<p>a. protect your passwords by using one of your trusted authentication mechanisms<\/p>\n\n\n\n<p>b. reduce the need for you to remember and reuse passwords<\/p>\n\n\n\n<p>c. encourage you to select strong, unique passwords by generating them for you<\/p>\n\n\n\n<p>d. assist you in logging in&nbsp; more securely to services which require passwords<\/p>\n\n\n\n<p>e. check your credentials against known compromises and prompt you to change those which are affected<\/p>\n\n\n\n<p>Now some of this may seem counterintuitive but let it sink in -the fewer passwords we need and the less human contact we have with them, the better.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">LOCKING IT ALL TOGETHER<\/h3>\n\n\n\n<p>We\u2019ve established that:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Longer passwords are more effective<\/li><li>Complex passwords are not<\/li><li>Common patterns in passwords reduce the effective length making them weaker<\/li><li>Changing password regularly encourages risky behaviour<\/li><li>Monitoring behaviour patterns to detect risks and potential compromises is a good strategy<\/li><li>Forcing regular password changes does not increase security<\/li><li>The fewer passwords, the better<\/li><\/ul>\n\n\n\n<p><strong>Advice For Admins<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Require at least a 12-digit password, but<\/li><li>Do not require complexity. Encourage colleagues to use memorable phrases instead<\/li><li>Check for common patterns when users create passwords \u2013 these significantly reduce the effective length of a password and, therefore, the strength<\/li><li>Do NOT force periodic changes \u2013 it encourages patterns. A strong and stable password is better<\/li><li>Force changes on security events \u2013 Enable identity protection, watch for suspicious behaviour, check against known compromises. If you (or your tools) think a password may have been compromised, require additional authentication, and force a password change<\/li><li>Enforce uniqueness. If you are only forcing passwords to change when you have cause for concern, then there is no excuse for users to repeat a password<\/li><li>Enable modern authentication and establish trust through context, devices, behaviour &#8211; this is much more robust than having someone enter their password manually several times per day<\/li><\/ol>\n\n\n\n<p><strong>Advice for Users<\/strong><\/p>\n\n\n\n<p>1. Rather than using short, visually complex passwords, think of a memorable phrase made up of 2 words or more \u2013 it doesn\u2019t matter how simple it is for you to remember; it\u2019s the number of characters which counts<\/p>\n\n\n\n<p>2. Don\u2019t include any words or patterns which are associated with your identity or those around you;<\/p>\n\n\n\n<p>a. avoid people, company and place names, ID numbers or job related information<\/p>\n\n\n\n<p>b. avoid repeating characters, words or patterns<\/p>\n\n\n\n<p>3. Use a password manager \u2013 let it suggest good passwords, let it store them for you but make sure you take the security around the password manager seriously<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">WHAT NEXT?<\/h3>\n\n\n\n<p>And a final thought &#8211; don\u2019t delay. The measures discussed here may look overwhelming, but many make the end-user experience SIMPLER rather than more challenging, so they will thank you for implementing them.&nbsp;<\/p>\n\n\n\n<p>All the major platform vendors and identity providers have their own feature sets to support these measures so start to look for areas where you can improve identity management and protection, detect risks, enable and encourage better password behaviour and chip away at the problem little by little.&nbsp; You can do it!&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Passwords and codes have been a mainstay of security since the dawn of time. Codes to allow you entry to the castle, to prove which side you\u2019re fighting for, to establish membership of your gang at school or to exchange messages with your first loves.&nbsp; Aah.&nbsp; In the modern era, they\u2019ve come to be used&hellip; <a class=\"more-link\" href=\"https:\/\/www.insentragroup.com\/gb\/insights\/geek-speak\/secure-workplace\/pass-the-passwords-to-the-left-hand-side\/\">Continue reading <span class=\"screen-reader-text\">Pass the Passwords to the Left-Hand Side<\/span><\/a><\/p>\n","protected":false},"author":94,"featured_media":6339,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[20],"tags":[],"class_list":["post-6338","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-workplace","entry"],"_links":{"self":[{"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/posts\/6338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/users\/94"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/comments?post=6338"}],"version-history":[{"count":1,"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/posts\/6338\/revisions"}],"predecessor-version":[{"id":6340,"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/posts\/6338\/revisions\/6340"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/media\/6339"}],"wp:attachment":[{"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/media?parent=6338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/categories?post=6338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insentragroup.com\/gb\/wp-json\/wp\/v2\/tags?post=6338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}