While security has never been more important than it is today, the fastest way for an IT professional to become the most despised person in the company is to start enforcing a strong password policy. A policy perceived as overbearing may cause people to write down their passwords on a sticky-note near their computers, circumventing its very purpose. Your policy will be ineffective if your users don’t know how to create strong passwords that are easy to remember.
Left to their own devices, people will choose passwords that are simple for them to remember. They’ll use their spouse’s name, their dog’s name, their favorite sports team or a recent vacation spot.
Sometimes while working on a user’s computer, I’ll need to log on as them following a reboot. Unfortunately, they’ve wandered off, not wanting to hover over the IT guy. I generally prefer not to know other people’s passwords, so I usually don’t ask. In this situation, I sometimes take a guess. I’ve been right a surprising number of times, and sometimes with people who are very powerful. It’s easy. I simply glance around their offices and note what their obsessions are.
Clearly, password policies are needed.
By using these following tips, people will be able to create easy to remember passwords that follow these typical requirements: at least eight characters long and with at least 3 of the following character types: upper-case letters, lower-case letters, numbers, and special characters.
- Substitute numbers for letters and vice versa. (o instead of 0, 4 instead of A, 1 instead of L, E instead of 3)
- Substitute words for numbers (one, two , three…)
- Combine both the of above (0ne, thr33, f1ve)
- Use capitalization in random places (bLue, happY)
- Use special characters ( !@#$%^&*(){}[] ) to punctuate and separate words
- Create passwords out of words, numbers or phrases you’ll remember
- Misspell words
Using these tips, you can create memorable passwords that will be nearly impossible to guess. Here are some examples of converting memorable information into a complex password
We’ll start with some easy ones:
- Friday becomes frYday!
- Robert becomes #robERt#
- 867-5309 becomes 8siX753o9
More complex passwords:
- 19 Peach Place becomes: 0ne9peacHpl!
- I love Jill becomes: eYelov3Jill
- My dog Fritz becomes MeyedogfrltZ
While some of these examples look nearly indecipherable, you can see how they’re not difficult to memorize–as long as you know the originating word, number, or phrase, and the basic methodology used to create it. By educating users on how to create strong passwords, you strengthen the security of your company, and your users will benefit additionally by have safer personal experiences with online banking and social networking.
[Michael Scalisi is an IT manager based in Alameda, California.]