IT security starts with a good password

Originally published in GP magazine .

Written for GP magazine around 2008. This is the version I submitted - the published article may have been edited.

The first part of any IT security strategy is to have good passwords. A good password is long and has a mix of upper and lower case, numbers and punctuation marks. This means that each digit can be one of over 80 possibilities, rather than 26 if you stick to just letters.

Unfortunately, although people have been told to add numbers to their passwords, most just use a common word with a number after it, and several studies have shown the most popular password has changed from “password” to “password1”.

A lot of people will use their child’s or pet’s name, or another name that is familiar to them; however, these are very insecure. Password crackers are programs that try to break into your files based on a dictionary of common names and words. In tests, the clever use of a dictionary of 60,000 words will break most passwords. While you might notice someone trying 60,000 times to log on to your desktop without success, if someone manages to copy your hard disk or USB drive a standard password isn’t that secure.

There are several interesting ways of thinking up strong passwords. One is to use phrases that are memorable to you. For example, “I love 2 go to restaurants for dinner” could be il2g2r4d, or if I press the shift key every other letter I get iL2g@r$d. For the mathematically minded, this method will have a higher number of 2s and 4s than true random, but it is a start. You could try something like “my mum’s telephone number is 274512 and she lives at 84 rose drive” to give mMtNi@7$5!2AsLa*4Rd, which is getting pretty difficult to guess but is surprisingly easy to remember, as long as you use the real details.

Other methods include using programs that generate completely random passwords of any length; however, these can be very difficult to remember without writing them down. The risk of this depends on what the password is being used for. If it is to log on at work, then writing it down on a file in your drawer isn’t that good; however, if it’s to secure an encrypted file which is to be kept off site, then it doesn’t matter if the password is written down and kept in a safe.

As it is a good idea to use different passwords for different files, there are several programs available that allow you to save all your passwords in one password-protected file. I have an excellent program on my iPhone that stores all my passwords. I also have a password generator on it as well, for when I need a new one.

The next step for security is to enforce the usage of passwords. It is surprising the number of people that don’t lock their terminals when they are not around. You can password-protect screensavers and make the computer log out after a predefined period of inactivity, and although this can be a pain, you should do this at home as well on any machine you use for work. I personally think systems that ask you to change your password all the time are asking for trouble, in that this is where people start using all the same words over and over again, and it is better to have one long one that lasts.

At work your IT department will have set up user accounts; however, at home or on a laptop it is vital you use this function as well, with password access to prevent people just accessing all your information. Having your kids or spouse using your computer to surf the net while work emails and files are accessible is wrong. Windows XP Professional, some versions of Vista and Mac OS X all allow you to create user accounts to allow different people to use the same computer securely, and you should turn on encryption as well - as, if you don’t, in theory someone could take the hard disk out of the machine and access it directly without a password.

XP has encrypted folders, and Vista has improved on this with a system called BitLocker that is very secure and secures the entire hard drive. It even has options where you have to insert a pre-prepared USB stick before booting the machine to get it to work. Apple Macs have something similar called FileVault and secure memory, though they are password-dependent, not based on a stick.

Now we have a secure computer with a proper password; in my next article I will talk about how to send information securely to someone else.