And the Password Is...

By Edward Smith

May 2, 2005

(And the Password Is... :  Page 1 of 1 )

On the 70s game show Password, contestants provided single-word clues to each other as they attempted to guess the secret password. When they guessed correctly, contestants won cash and valuable prizes. Surprisingly, today's real world of password security works pretty much the same way.

A world of security policies and "best practices" exist that address password security. Following is a recap of some of the password instruction I've been given over the years:

• Use passwords between 8 and 15 characters
• Use a combination of upper and lower case characters
• Don't create passwords that include your spouse's or children's names, or any other personal information that could be easily guessed
• Don't use common words
• Don't use common words spelled backwards
• Don't use words substituting numbers for letters
• Include random characters
• Use a pass-phrase rather than actual words
• Don't write passwords anywhere
• Don't keep passwords in a PC file
• Don't keep passwords on PDAs
• Don't share passwords with others.
• Don't place passwords on a sticky note on the PC, under the keyboard, in a wallet, or any other typical hiding places
• Change the password at least every 90 days, and preferably every 30
• When changing passwords, don't just add "1" to the current password (i.e. mydog12 to mydog13)
• Use a different password for all logins to reduce loss if a single password is compromised

I've come to a conclusion regarding corporate password security—it generally isn't effective.

Let's face it—we're only human, which is a significant part of the problem. The typical human mind can't easily remember complex passwords like i5oPhT6k(fi. The complexity increases further if you need to change those passwords every 30-90 days, and then remember the new one. You also need unique passwords for all systems scattered throughout your work environment. I currently have more than six logins to access my corporate network, and another two dozen or so that enable me to access my banking, rewards programs, and everything else that my personal virtual world requires today.

 Page 1 of 1