Thursday, January 26, 2012

Passwords

Pursuing through the many news topics today I came across this one. Symantec has lost code for PC anywhere and offers a few tidbits of helpful information to keep your PC safe. I would say they needed to go farther with this.

As a someone who as been in the IT field for a long time nothing is more time consuming than passwords. You have to change them at least every 6 months and monitor access to critical systems to make sure they are not being used when you are not there. I however discovered that having a layer of passwords is much less painful, time consuming, and ultimately more secure since a compromised password would only get access to one layer.

Layer 1 are simple passwords (such as qwerty01) to sites that I have little or no worries of any personal information being compromised. Fire arm blogs, news sites, computer sites ect ect.

Layer 2 get a slightly more complicated password one that uses the 8 charater minimum with Upper and lower case and a special character (H0t@0N3!). This is for more personal sites like job sites or web applications that require SSN# or mailing addresses.

Layer 3 is for financial sites; Those that have any bank information and credit card information. In fact if you have more than 4 credit cards I would say that you split them on a different layer like Layer 3a and Layer 3b. This is the type of information that if hacked would keep you up at nights worrying.  I would go to a full 16 character random password on these if at all possible. (Kt6#l0sdT4$l1f&)

Layer 4 is the last layer typical assigned to email accounts and admin passwords. Also called you are going to have to write this one down password. I go to the 32 character range on this one. You can also make this your login, but really windows logins (for home anyways) are to prevent someone to remotely log into you machine. You can use a level 2 for a windows login.

So if any area is compromised/hacked you only have to change one level and not the whole structure. You are going to have a compromised password period. It is only a matter of time unless you don't use anything online (if you are reading this you are). Typical caveats apply here do not give any passwords to anyone, even if they "claim" to be of that particular institution/organization. System administrators know what your passwords are, or they can find out really fast. They have no need to ask you what they are. Also keep your passwords fresh; change then at least once every six months. This will ensure that even an old password has been stored they can not use it later on.

Online presence has become even more important in the digital age make sure that yours continues to belong to the right person.

2 comments:

  1. Why thanks Stephen, I hope others find it useful as well.

    ReplyDelete