According to a 2018 security report by LastPass, 50 percent of people do not generate different passwords for work and personal accounts, and despite the fact they are generally unliked, passwords are the key to accessing the IT resources people need.
Managing passwords (and helping to secure them) for an organization is one of the main duties of IT, and an important one at that. Hacking has the potential to lead to total loss of confidential information or a breach of PII (personally identifiable information).
In a modern society that thrives on the excitement of innovation, it is important to adhere to strong principles surrounding security so that the wealth of digital information remains confidential.
Here are our top three password management practices to prevent security becoming a casualty of ease of access.
1. Create long and complex passwords
Jaw-droppingly, the most widely used password of last year was “password.” (JumpCloud) In addition, according to a 2017 report by LastPass called The Password Expose, 61% of people use the same or similar passwords everywhere.
Weak and short passwords, or any combination of the two, are substantial enough to welcome the threat of hackers. Between the months of April and June of 2018, 765 million people were affected by data breaches and cyberattacks, showing a 47 percent increase in malicious activity from the months prior and resulting in losses exceeding tens of millions of dollars. (USA Today). As accessibility to IT has advanced, so has the concern for greater cybersecurity.
It is advised that, as computers become more advanced, so should the passwords protecting them. Generating long, complex passwords helps prevent against phishing attacks, as well as computer-based hacks. IT admins advise that passwords be a minimum of 12 characters, but we suggest increasing to an 18-character minimum. (JumpCloud)
2. Store strong passwords in a password manager
Finding the ideal 18-character plus, uncrackable password can be a feat within itself, and one never wants it to be lost — or in most cases, forgotten. Password managers work to store login information and provide quick and easy access to commonly used websites. A password manager can be a handy tool to avoid reusing the same passwords over multiple sites. Instead of having one arguably weak password for upward of 15 different applications, you can use a password manager to make building strong, unique passwords for every site easier to implement.
In many modern organizations, the password manager effectively is a portal that connects users to their applications via single sign-on. In this scenario, a user only needs to remember their long password to enter the portal and then a protocol called SAML helps assert the person’s identity to the web applications that they need to access. JumpCloud’s SSO platform can help organizations with this approach to secure user access.
3. Apply MFA everywhere
Multi-Factor Authentication (MFA) is one of the best ways to secure a set of credentials. Enabling that extra factor makes it significantly harder for hackers to utilize a compromised set of credentials to access sensitive resources. Even if you’ve employed strong, unique passwords on all of your accounts, MFA stands as a last defense against would-be hackers. Symantec claims that, in recent years, upward of 80% of data breaches could have been prevented with MFA. JumpCloud’s MFA system adds another level of security that, when all else fails, offers a simple way to secure all applications accessed by the user portal.
More Security Best Practices
Proper password management goes beyond just three practices, but these are a surefire way to exponentially increase the security on any system.
For a more comprehensive look at security best practices, take a look at Security Training 101: Employee Education Checklist.
Password Security and More with JumpCloud®
JumpCloud’s Directory-as-a-Service® is the first platform to combine the power of directory services with the flexibility of the cloud. JumpCloud provides a single identity that can securely connect users to systems, apps, files, and networks.
While JumpCloud isn’t a password manager per se, it can help with securing access to a wide range of IT resources through techniques such as password complexity and MFA. Both come included. With Directory-as-a-Service, admins can require MFA on a wide range of resources, including:
- macOS and Linux workstations and servers
- Web apps and cloud infrastructure
- VPN network access via the RADIUS protocol