The Verizon Data Breach Investigations Report for 2016 tells us 63 percent of small business hackers take advantage of weak passwords. What’s more, almost all (93 percent) took mere minutes to compromise systems. It all spells big trouble for America’s small business unless you focus on beefing up your passwords and adopting a policy. Follow these 20 password policy best practices to keep your company secure.
Password Policy Best Practices
Understand What Password Policy Is
First you need to walk before you run. Understanding what a password policy is the first step in being able to build a strong one. These are a set of rules covering how you design the combinations of words, numbers and/or symbols that grant access to an otherwise restricted online area. Passwords can protect your website, software programs and small business networks. They keep them safe from unauthorized entry from ex-employees, curious intruders and of course hackers.
Adopt the 8 + 4 Rule
This rule helps you to build passwords that are strong as steel. Use eight characters with one upper and one lower case, a special character like as asterisk and a number. The more random the better.
Keep Symbols/Numbers Separate
Here’s another hint for an effective password policy to foil hackers. Make sure the numbers and symbols are spread out through the password. Bunching them up makes the password easier to hack.
Don’t Make it Personal
Everyone involved in a small business needs to understand there’s a big difference between security and convenience when it comes to passwords. It needs to be clear using personal information like your first name and birth date is a recipe for disaster. If a hacker ever gets his hands on company HR data, this information will be the first set of combinations he tries.
Use Different Passwords for Different Accounts
Even if there are several computers in the same department, it’s a bad a idea to cut a corner by using the same password for each. Use a different one for every device.
Avoid Dictionary Words
It might sound safe to go to the dictionary for a password, but hackers actually have programs that search through tens of thousands of these words. Dictionary attack programs have been around for years.
Keep the Character Limit Down
The average person can only remember 10 characters or less. Long passwords run the risk of being written down so they can be remembered.
Adopt Passphrases
Abbreviations are usually immune to dictionary attacks. So TSWCOT for The Sun will Come Out Tomorrow is a good choice for a secure password. Remember to add symbols and numbers.
Don’t Change Them Too Often
A good strong password will last for a year or more. Don’t encourage employees to change them any more frequently than that. Otherwise you can wind up with a password1, password 2 situation. Hackers look for these patterns.
Don’t Write Anything Down
Granted, committing all of all your passwords to memory might get tricky. However, everyone under your small business roof needs to understand not to write anything down. A discarded Post-It can be all a would be hacker needs.
Discourage Sharing
No one should share passwords over any electronic media. If you cant find a way of sharing a password without using cyberspace, make sure everyone knows to change it right away afterwards.
Add Other Barriers
When you’re putting together a password policy, make sure to look at the bigger picture. Well designed passwords put a good lock on the online front door of your company. More robust authentication like a fingerprint scanner make your small business safe like Fort Knox.
Encourage Weirdness
In the passwords and not your employees, that is. Still, they should understand the best passwords avoid pop culture and sports terms and anything that’s common. Random groupings of the 8+4 rule works but so do unique phrases.
Adopt Stronger Policies for Sensitive Accounts
Administrators need to have more robust rules for setting passwords. The more data they have in their electronic baskets, the stronger the policy needs to be.
Enforce the Policy
It’s important your password policy has disciplinary teeth. Be clear about what happens for infractions all the way up to dismissal.
Set a Lockout
We’ve all legitimately forgotten a password and need a few tries to get back in. However you should set a number that will lock the user out after a few unsuccessful attempts. Four failed logins works.
Stay Away from Acronyms
Don’t use these as a shortcut to identifying your department or who you are. It might be temping for an accountant to use CPA. However, that opens a cybersecurity door wide enough for a hacker to walk right through.
Never Use Remember Password
Search engines and email programs mean well when they ask you this, but in the end it’s just another risk your small business doesn’t need to take.
Never Tell Anyone Your Password
A good policy will stress that no one should ever tell anyone else their password. The systems administrator needs to play gatekeeper here. If someone wants to know a password, they need to go to them.
Keep the Process Private
Finally, stress to everyone involved they need to hide the process from prying eyes. No one should be watching when you type in your password.
Password Photo via Shutterstock