There are numerous password threats or tools used to coerce company employees into giving up their password, either knowingly or unknowingly. Hackers wishing to gain access into an account will use a variety of methods including phishing, guessing, shoulder surfing, a dictionary attack or keystroke logging. Each one of these methods is used as a way to capture a password and gain access to company information. It is essential for every employee to minimize their exposure to each one of these threats, which can be defined by:
- Phishing –This threat often appears as an impostor email that is used to trick an employee into entering a unique username along with the password. It usually appears as a link to a website that poses to be a legitimate, financial service account, payment processor, or auction site. Typically, an employee will type in confidential information to the bogus site without realizing it is not legitimate.
- Guessing –Human behavior is a funny thing, as it is so often predictable. Without strict company policies firmly in place, an employee will likely create an extensive list of very simple passwords that can be easily guessed. Many passwords are often used by employees including “password”, “passcode”,“12345”, “qwerty”, “admin”, or any row of letters directly off of the keyboard. It might also include names, dates, birth years, or any combination of these choices. Guessing is extremely easy for an online hacker, who understands the predictability of human behavior.
- Shoulder Surfing –Anytime an employee is out in a public area including the airport, library, café, restaurant, or mass transit, it is easy for others to look over their shoulders and do “shoulder surfing”. By watching the employee type in their password, it is easy to steal this valuable information to gain access to a company account. Even if the employee is not logging in to a company account, they most likely use the same password for their private accounts as they do for the ones at the office.
- Dictionary Attacks –Using a specialized software program, online cyber-thieves can let their computers easily guess employee passwords by trying every word in a dictionary, along with unlimited combinations of words, and numbers, symbols, and signs.
- Keystroke Logging –There is an endless variety of Trojan horses, programs and viruses that can instantly, and serendipitously, install themselves onto any computer at the office or at home. These effective programs can easily capture and communicate exactly the type of keystrokes we make while logging on to accounts online. Almost instantly, the keystroke logging software program will send information of exactly what words are used for user ID, followed by the exact typing of a password, passphrase, or password combination.
Great Password Practices
When employees take a proactive approach at safeguarding passwords to deter others from gaining access into company accounts, they can always follow these three great password practices, which include:
- Guard against Phishing – Never click on a link in an email. Instead, go directly to the company website and login to your account at their location.
- Guard against Guessing and Dictionary Attacks – Create passwords that are at least eight characters long that include uppercase, lowercase, numbers, and symbols which cannot be easily guessed.
- Guard One Account from another – Create a unique password for every account. If the hacker gains access to one of your accounts, they will not have access to any others.
Although it is up to the company (with the aid of their IT manager or IT consultant) to direct employees on the best practices and procedures for developing effective passwords and passphrases, it is the responsibility of EVERY employee to safeguard critical, confidential information. By using a password manager and two-factor authentication, companies can minimize the potential for online attacks, while safeguarding their vital data. As an example, Wolf Consulting, Inc. recently implemented the AuthAnvil password manager and two-factor authentication technologies from Scorpion Software.
Which brings us back around to the big question: How many passwords fit on a single sticky note?
The answer is… Zero.
Probably the easiest way for a hacker to gain access into a company account is to watch the employee at their desk. Many employees at their desk often leave their passwords on sticky notes in plain sight of any passerby. Even the ones that do not use sticky notes tend to find common things in their environment at work to create their unique password. An example might be “pottedplant123”. By writing down any password and leaving the information around the employee’s desk, or choosing a password based on something within plain sight, is an easy way to put the company at risk of being hacked from the inside.
If you are looking for help with password policies, practices or technologies, please contact us today to see how we can help.
Published with permission from Dana Epp and Scorpion Software.
Windows 8 and Office 2013 are generating lot of buzz. When meeting with clients and prospective clients, we’ve been hearing a fair amount of questions about the new Windows 8 and the new Office 2013. The questions typically focus on what these technologies mean for their business.
Wolf Consulting, Inc. has been named to Nine Lives Media’s MSPmentor 200 North America Edition for 2013, an annual list identifying North America’s top 200 managed service providers (MSPs). MSP’s are firms that provide a variety of computer networking and Information Technology consulting services and proactive support services to keep the computer networks of their client organizations running smoothly.
Wolf Consulting has proven to be a valuable partner for us from the very first day. Our previous IT company had not setup a backup solution for our data and they had not built in any redundancy on the server. To make things worse, our server crashed and we were unable to access any data. This put us in a very dangerous situation. Fortunately, Wolf Consulting was able to utilize their partner network to recover most of the data, expedited the purchase of a new server that was properly configured, and got us back up and running in a short period of time. With this type of on-going strategic planning, monitoring, management and support, I know we are in much better position today than we were prior to partnering with Wolf Consulting. I can, without reservation, recommend Wolf Consulting for all your IT management and support needs.
Wolf Consulting is a member of HTG Peer Groups, a national and worldwide network of IT solution provider owners and executives formed to collaborate and share business best practices. The entire organization consists of approximately 250 IT solution providers. HTG members participate in a subgroup consisting of 10-12 non-competing and geographically separated companies that work together to enhance each other’s professional and personal development in a fast-paced, increasingly evolving industry. Wolf Consulting joined HTG Peer Groups in early 2010, and is a member of the HTG22 subgroup. Besides Wolf Consulting from Pittsburgh, HTG22 has member companies from Colorado, Kentucky, Kansas, Louisiana, Nebraska, and three cities in Texas.
