Password Controls
18/02/2019

Passwords – the last control that prevents malicious people from accessing everything that you have access to.
It is a good idea to make your password a good one. Your password is valuable to different types of people.
Some people might want to look into your personal life. If they know you or can find out information about you through things posted online, they might be able to guess one of your passwords. If this is your email password they can use email access to reset the passwords on all your other accounts.
If your password is less secure the attacker may simply automate an attack on your password. In this case millions of attempts are levied against your account and weak passwords will be broken.
If your password is leaked it might be a while before the company which lost your password informs you about it.
https://www.bbc.co.uk/news/technology-47044652
Where this happens criminals may have access to your password for a long time and you will be unaware of this access. In this case if you are using that password in more than one place the criminals have more than enough time to try numerous sites on the internet to see if that access succeeds.
To help withstand the majority of these attacks a password of decent complexity is your best weapon. Every year a report is published of the worst passwords used. In the majority of cases the very worst passwords are in use by thousands of people
https://www.digitaltrends.com/computing/top-100-worst-passwords-2018/
The list is common knowledge, so criminals know about these passwords too and when trying to access an account will use these first.
For this reason it is important to set a secure password which is not on this list.
There are a great many sites that can give advice about password choice https://nakedsecurity.sophos.com/2014/10/01/how-to-pick-a-proper-password/
All passwords are guessable and the key is to make them long enough to withstand repeated guesses or an automated dictionary attack.
The currently policy https://intranet.cranfield.ac.uk/it/PoliciesandProcedures/NetworkPasswordPolicyforITSystems.pdf states that passwords must be at least 8 characters, and contain a combination of numbers, symbols, uppercase letters, lowercase letters, and spaces. The password would be free of repetition, dictionary words, usernames, pronouns, IDs, and any other predefined number or letter sequences.
A popular way of constructing passwords is through the use of passphrases – short random words – that, when used with the advice above, can form strong complex passwords.
Long passwords, tend to be cumbersome to use, passwords longer than 12 characters tend to be particularly tough to enter on a mobile device for example. In these cases it is generally recommended to make use of a password manager:
https://www.lastpass.com/business-password-manager
These generate random passwords for you, store all your passwords and so the only password you need to know is the ‘master’ password for the password manager.
For obvious reasons it is very important to make sure that the password you use for the password manager is a highly secure one.
Passwords which are breached are used by criminals in a number of other sites to see if they can gain access. This can occur often months before the account owner is even made aware that their account has been breached. This means that it is critical that each and every password you use is unique (i.e. you do not re-use passwords for different services). This is made easier by a password manager.
To ensure that your chosen password is not one that has been in a previous security breach you can make use of the password checker at https://haveibeenpwned.com/Passwords. Which also offers a notification service if your account(s) ever appear in a security breach (if you sign up to this free service) https://haveibeenpwned.com/.
Occasionally problems are reported with password managers themselves, however be aware that the stronger the main password (for accessing your password manager) the less likely anyone will gain access to it.
Categories & Tags:
Leave a comment on this post:
You might also like…
Setting up a private group on Mendeley to support your group project
Many of our students are busy working on their group projects. Our top tip is to set up a private group on Mendeley. You can use it to store all your references, and to share ...
Tell us what you think of Library Services!
We want our students to have a great experience during their time at Cranfield. Each month, the University runs a short “Topic of the month” survey to focus on one service or facility and find ...
Air Transport Management alumni stories: SangHo (Henry) Han, Strategic Planning Manager in South Korea
SangHo (Henry) Han is a strategic planning manager at Air Premia in South Korea. He graduated from Cranfield University with an MSc in Air Transport Management in 2018. Here, Henry talks about his passion for ...
Life on campus and studying an Advanced Water Management MSc at Cranfield
After a year of working in the water, sanitation, and hygiene sector, I started to look for opportunities to further my knowledge about water resources. Researching water organisations on LinkedIn led me to find ...
Sign up to our ‘Making your research open access’ webinar – 9 February
Do you know your green from your gold? What are publisher deals, and how can they help you? My paper acknowledges UKRI funding, do I need to do anything special? What does an author accepted ...
How the Executive Logistics and Supply Chain Management MSc improved my career outlook
Hear from Harrison Jnr Ilodiwe, Executive Logistics and Supply Chain Management MSc, on his student experience at Cranfield. Why did you choose to study the Executive Logistics and Supply Chain Management MSc at Cranfield ...