Page 17 - PA_Enterprise_March-2024

PAE
The problem here is that human nature is
Help employees make complicated. It’s not just that users don’t
want to expend precious cognitive energy on
remembering unique and complex passwords
strong passwords a for every account. Often, they’re trying to avoid
the feelings of frustration that accompany their
failure to easily recall the information. Simple
and familiar passwords will always trump
habit complex and more secure ones. Sadly, the
human factor of password security boils down
to what’s easy rather than what’s secure. May
the password gods forgive us.
We’ve seen how this plays out. Despite
knowing the risks of weak passwords, which
are vulnerable to brute force attacks, and
repeating passwords, people do both over and
over again. According to a 2019 Google poll,
over 52% of users admit to reusing passwords
and approximately 13% admit to using one
password across all accounts. Simultaneously,
68% of password users admit they reuse
credentials because they fear forgetting them;
and 36% do not consider their accounts
valuable enough to need more stringent
security measures.
So what can companies do? The good news
is it’s not a question of choosing between
gold standard security or nothing at all.
Instead, companies need to find the approach
that works best for their people — and that
employees will actually follow. Here are five
recommendations that managers and IT
departments can share with employees and
teams to help them find — and use — the right
level of protection for any situation.
Level One: The throwaway password
A throwaway password is one that is utilized
with a throwaway email address. If you’ve
ever created a burner email address to use a
March 2024
free trial, the idea is much the same. These
single-use accounts are particularly useful
if you know you’re going to be immediately
subscribed to an endless barrage of
unappreciated sales emails for the rest of
that account’s lifetime (‘unsubscribe’ buttons
be damned). The unimportant passwords for
these trivial accounts provide protection in
their insignificance. If (when) these passwords
are stolen or these accounts are hacked, no
This theft will not put any critical accounts or
critical information or passwords are lost.
passwords at risk.
For these accounts, you could actually use
a password as simple as a word, a few
letters, and a special character. For example:
Frodo123! But never use this password again
with any other email account. Reusing a
simple password across multiple platforms can
be the kiss of death.
Level Two: A password phrase
Four- or five-character passwords, regardless
of the combination of numbers, letters, or
symbols, are similarly vulnerable. That’s
why experts now recommend at least a
12-character password. The problem is
that no one likes to remember a bunch of
long, complicated passwords. Here’s where
password phrases come in.
A password phrase is longer in length than
a simple one-word password but easy to
remember. Most of us should be using
password phrases instead of words to
increase character length, but they should
not be something as simple as song lyrics
(professional hackers have been on to this
ploy for years). Using ‘everybreathyoutake,’
‘oopsididitagain,’ or ‘igottafeeling’ is practically

17