Creating Secure Passwords

• Starting with a weak password can lead to security breaches.
• A strong password is a key defense against cyberattacks.

Creating Secure Passwords

• Do not reuse common words, names, phrases, or dates
• Secure passwords should be non-dictionary words or unusually spelled words
• Use letter substitutions with numbers or symbols (e.g., 11k3 th1$)
• Passwords are case-sensitive, so mix uppercase and lowercase letters (e.g., m0R3 L1k3 tH1$)
• Utilize a minimum of eight characters or less than 16 characters, with a maximum of 64 characters
• Complex passwords offer enhanced protection compared to simple ones

Password Types

• Weak passwords are simple, easily guessed, dates, or universal
• Strong passwords are alphanumeric, random, or pattern-based

Weak Passwords

• Simple passwords involve common dictionary words
• Adding numbers to words does not significantly improve security (journalist = journalist1)
• Easily guessable passwords include names or terms linked to you
• Passwords based on dates are easily cracked
• Using a single password across multiple sites is a "universal password" which poses a significant risk if one site is breached

Strong Passwords

• Alphanumeric passwords use letters and numbers, with special characters increasing effectiveness
• Random passwords consist of non-word characters that are hard to crack
• Pattern-based passwords use keyboard patterns for unique combinations

Alphanumeric Strong Passwords

• Start with a simple word and make substitutions to increase complexity (Kelly becomes K3l!Y437)

Random Character Strong Passwords

• Use software tools like password managers (Dashlane, Keeper) or browser features (Mozilla Firefox) to generate and store unique passwords
• Pattern strong passwords use drawing shapes on the keyboard and taking every other letter

How Hackers Crack Passwords

• Dictionary attacks use software to test dictionary words as passwords which can be cracked within 5 minutes
• Brute force attacks use software with machine learning and AI to try various combinations until the password is found in days to billions of years
• Rainbow table attacks and network analysis are techniques used to match passwords to decryption keys or intercept network data
• Phishing involves receiving a malicious link via email to download malware
• Social engineering involves emails from reputable sources that lead to scam websites for login credentials
• Spidering involves contacting individuals or organizations impersonating client for data theft

Reinforcing Passwords

• Avoid common passwords and never use the same password for multiple sites
• Keep passwords private and use password generators for secure, memorable passwords
• Change passwords regularly, especially on business and social media accounts
• Use password managers to track passwords instead of sticker notes
• Enable two-factor authentication, multi-factor authentication, or one-time passwords

Password Managers and Generators

• Password managers store passwords and auto-fill credentials using a master password
• They encrypt passwords, and check password strength and suggest updates for two-factor authentication is supported

Multi-Factor Authentication

• Multi-factor authentication combines two factors in a log in like, fingerprint or retinal scan as well
• Answer correctly

Secure Passwords

• Securing passwords can help to create to protect online accounts
• Unique password, and complex password is recommended
• Two-factor authentication should be enabled when available
• Buying the best antivirus is key security
• Phishing attempts should be avoided

Password protection

• Robust passwords should integrate a mix of upper and lowercase
• Passwords should avoid repetition and should be changed periodically
• Do not share passwords

Password Types

• Weak Passwords like Simple, Easy to guess, Dates and universal passwords should be avoided
• Strong passwords like alphanumeric, random and pattern-based should be used

Password Meanings

• BIOS password prevent unauthorized users from making changes to system hardware and software settings
• System password prevents unauthorized user from using the computer
• Administrator password helps you fully operate window
• User password means the unique codes, words or identification

Password Attacks

• Brute-force attack
• Keylogger attack
• Dictionary attack
• Credential stuffing
• Man-in-the-middle
• Traffic interception
• Phishing
• Password spraying

Brute-force attack

• Use software involving automated methods

Keylogger attack

• Records a user's activity by logging keyboard strokes

Dictionary attack

• Based on a list of commonly used words as well as often-used passwords

Credential stuffing

• Attackers use trial and error to gain access

Man-in-the-middle

• Scenario involves 3 parties
• The user, the attacker, and the third party

Phishing

• Cybercriminals use different phishing and social engineering tactics
• Phishing attacks typically create urgency for the use

Password spraying

• Involves trying a large number of common passwords on a small number of user accounts

Prevent Password attacks

• Best practices for password hygiene and management
• Passwords should be long, complex and Unique
• Multi factor authentication should be implemented when possible
• Password managers simplifies and secures storage

Securing Web Browsers

• Browsers can be exploited

Targeting the browser

• Browser handle many different types of media and functions

Targeted Aspects

Connections to online resources (eg, DNS servers, websites)

• Plug ins installed on the browser -Vulnerabilities in the browser itself

Hardening the browser

• Update to the latest version along with regular releases

Updates Include

• Anti-phishing, anti-malware, plugin security, and sandbox

Use limited user account

• Restricts account from malware and allows less freedom

Security Settings

• Customize these settings to the highest possible
• Enable block reported attack/ fake websites
• Completely disable cookies unless trusted
• Block pop up windows unless trusted
• Block Java Script unless trusted
• Block running of cameras/ microphone unless trusted
• Block plugins and add-ons unless trusted

Additional Steps

• Use reputable antivirus solution and virtual private network
• Use security focused search engine

Workarounds

• Update or modify browsers
• Not using a newer version
• Not using weaker security settings
• Specific version web browser is required

To Improve security use

• To browsers, the first with required setup for business operations
• Isolate the web browser for operating system using a sand box

Web Browser

• Browsers retrieve information

Security

• Secure by default such as Site isolation, sandboxing, and predictive phishing protections
• Chrome, Mozilla Firefox, Opera have security features