Passwords

Passwords are the most important links in the chain of computer defense. Unfortunately, passwords, and the need for strong passwords, are the things most often breezed over by users, or ignored outright. After all, once an individual has installed a firewall, anti-virus and anti-spyware products, secured their email, and backed up their data; they simply don't have the energy to remember a strong, secure password. Right?

Unfortunately, as internet citizens, we do not have the right to insecure passwords. If weak passwords are used, the consequences are innumerable.

Creating a strong Password

One of the hardest parts of creating a strong password is just that: creating it. We recognize that nobody really wants to memorize a completely random set of letters and numbers. We are hoping that these guidelines will help you select a password that achieves a balance of security and ease-of-use.

First, a few criteria need to be put forward describing what the ideal password will look like. Resnet staff recommend that your password fulfils all of these requirements:

• Be no less than 8 characters (so it is 'strong'), but no more than about 13 or 14 (so it is easy to remember)
• Be alphanumeric (contain a mix of letters and numbers)
• Not include personal information:
  • Names
    • Your name
    • Family names
    • Pets names
    • Nicknames
    • and especially usernames
  • Birthdays
  • 'Favorites':
    • Favorite colors
    • Favorite bands
    • Favorite movies
    • Favorite foods
    • etc.

To create your strong password, follow these steps:

1. Select a short phrase that has no significant meaning, but is easy to remember.
   Reading is Fun
2. Remove all of the spaces.
   ReadingisFun
3. Replace some letters (no more than half) with simmilar numbers.
   • I's and L's become 1's
   • T's and F's become 7's
   • A's become 4's
   • O's, Q's, C's and other round letters become 0's
   • E's become 3's
   • Others are also possible, you can make whatever substitutions you like as long as you remember them
   R34d1ng1s7un
4. If necessary, shorten the password to be between 8 and 13 characters.

This password will be secure enough for most purposes, provided you are careful with it. Do not share your password, the phrase used to create your password, with anyone. For truely sensitive data, such as financial records, consider using a random password generator.

When you are finished, you may wish to test the strength of your password. Microsoft provides this tool which will work well for this purpose. Notice that because Microsoft reccommends passwords at least 14 characters long, this algorithm will never create a password rated "best".

Keeping your password secure

The job of keeping data safe does not end with creating a strong password. Remember:

• Never share your password with anyone....ever!
• Do not use the same password everywhere. Resnet staff recognise that few users will create a different password for every account they use, so consider making a few different passwords for different uses (the types of accounts at the top of list should use the most secure passwords):
  1. Computer login accounts
  2. CWU network account (We call them Novell, NDS, or Safari accounts)
  3. Online banking accounts
  4. Email accounts
  5. Social Networking Sites (Facebook and Myspace)
• Do not save your passwords in your web browser.
• Change your passwords often: we require passwords to be changed every quarter, that should be sufficient for most other purposes as well.