It is a while since I have written about passwords – although I did do a deep dive into them and produced this Back-to-Basics primer:
Most people would have got the message, by now, that a password has to be complex.
The National Cyber Security Centre (NCSC) has an opinion on passwords:
The logic behind three random words – NCSC.GOV.UK
Even Randal Munroe has an opinion:
Brute Forcing a Password
Let’s get a definition of what a brute force attack against your passwords is:
“A brute force attack is a method used to crack passwords, login credentials, or encryption keys by systematically trying all possible combinations until the correct one is found. This approach relies on trial and error and can be automated using software to test a large number of combinations quickly.”
These bots are particularly effective against weak passwords, user who are using the same password for multtiple accounts and default passwords that have not been changed.
So what passwords do these automated brute force bots use?
Johannes Ullrich has examined nearly 10 years worth of data collected by the SANS Technology Institute and has detirmined that they still favour passwords with eight characters – so a password with more than eight characters will provide protection from this type of attack.
Quick Password Brute Forcing Evolution Statistics – SANS Internet Storm Center
This does not mean they do not include other longer common passwords in their lists – so forget just using the name of your favourite football (or for the Americans scoccer) team.
Your Takeaway
We advise using the NCSC three word approach but we add a bit of spice to the mix.
Make sure your team is using a different password for each service they log into and that those passwords are complex.
Need help getting the message across…
Clive Catton MSc (Cyber Security) – by-line and other articles
We will not be looking specifically at passwords as part of our summer webinar series but we will be examining the cyber security implications of poor credential management and making suggestions on how you can improve that management.
Hack Me If You Can! What’s your excuse? – Sign Up Here
Further Reading
Photo by Miguel Á. Padriñán
