What do you think when you hear the term “cybersecurity?” Do things like anti-virus, anti-malware, and firewalls come to mind? These are crucial factors in an appropriate, layered security plan. However, every practice needs another aspect of security that costs very little but can make a big difference - a password policy.
Passwords sit at the front line of personal and professional security. Passwords are used for virtually everything; financial accounts, social media, phones, streaming services, etc. They are, essentially, keys to the virtual gate. So, is your password policy secure?
Creating a password policy for your practice is your first defense against cyber attacks and hackers. And that’s why you need to ensure that you’re following password policy best practices. So, what exactly do you include in your password policy? Let’s take a look!
Creating Passwords
It’s pretty tempting to go after an easy phrase when creating a login. The problem is when a phrase is easy to guess it’s a prime target for hackers. They employ bots to attempt password theft, applications that run through millions of familiar phrases in hopes they discover yours.
To avoid this, you need to practice some healthy password creation strategies:
- Use caps/lower-caps letters, numbers, and special characters
- Use jumbled letters and numbers if you use a small login
- Create long logins exceeding 8-10 characters, if you can
Don't Reuse Passwords
No matter your profession, reusing passwords is a terrible idea. It’s dangerous and insecure. Many of your employees already know that reusing passwords is unsafe, but they probably do it anyway.
One survey found that (92%) of information technology professionals polled use the same password across multiple sites and over half share passwords with colleagues over email. If people whose job is information technology aren’t following some of the more basic protocols for keeping information safe, your employees aren’t either. That’s why you need to make it clear that your practice's password policy does not allow the use of passwords more than once. Employees are much more likely to commit to using unique passwords with an explicit rule.
Don't Overvalue Special Characters
When we create our passwords, we often overvalue complexity using special characters – this isn’t surprising. Nearly every website that requires a password gives us a set of variables that a password must meet. It must include a lowercase letter, an uppercase letter, a number, a special character, and the list goes on. However, these requirements can lead to predictable patterns and encourage users to repeat or write down passwords because they are harder to remember.
Instead, we recommend creating passphrases. A passphrase is typically longer than a password, although it’s not just the length that gives a passphrase strength. Interestingly, when users only focus on length, they also end up creating predictable passwords such as “passwordpassword” or “purplepurplepurple.”
Instead, focus on creating a unique passphrase that even those closest to you wouldn’t be able to guess. This means that you shouldn’t include your or loved ones’ birthdates or names or your hobbies and interests. Try to create a completely random, unpredictable passphrase, such as “The Park Next To My House Is Green.” This phrase may seem totally out of the left field, but that’s actually what makes it a strong password. Or should we say passphrase?
4 Tips for Making Secure & Easy to Remember Passwords
- Tip 1
Try replacing letters with their alphabetical equivalent. Let’s say you want to make “dog” your password. Instead, use “4” for “d” (since d is the fourth letter in the alphabet). Now you’ve got 4og. - Tip 2
Reverse names and phrases. So “4og” is your password. Let’s reverse that, so now it’s “go4.” This works great for longer password names. “house,” for instance, becomes “esuoh.” - Tip 3
Add random caps. We can make “go4,” say “gO4.” - Tip 4
Include an easily remembered number at the beginning or end of your phrase. Let’s say the birthday is the 16th, so now, our password becomes 16gO4. Or, gO416.
Storing Passwords
As you start creating unique logins (as you should), it’s easy for them to get lost in the various websites using them. Therefore, you might think to write them down or keep your logins in a document. However, this isn’t a recommended method. Not only does it set a bad precedent (creating an accessible point of high-value info), it’s dangerous for both individuals and companies.
Use a Password Management System
Although it’s a terrible idea to use the same password across multiple sites, it’s not surprising that individuals still do it. Most people have well over a hundred digital accounts. And each one requires a username and password. With that many passwords, it’s no wonder that people aren’t memorizing hundreds of unique sets of usernames and passwords. So instead, they cheat. Either they write all of their various passwords down, or they reuse the same password across multiple sites. Even worse, they may do both. And both are extremely dangerous.
Set them up with a password manager to keep your employees from picking up either of these bad habits. A password manager will allow them to store all of their unique passwords in one place and save them for future use. Many will also help generate strong, secure passwords for your employees.
Using a password manager securely stores and autogenerates passwords, so your employees won’t have to worry about remembering their passwords (which tempts them to reuse or write them down).
Sharing Passwords
Here’s where things get tricky. It is, in most scenarios, not recommended to share passwords, as it doubles the risk of said login getting leaked. It also goes against advice you commonly hear, which is “never to share your password with anyone.”
Often, malicious parties attempt to take your password by simply asking for it, claiming they’re part of an administrator/management team. It’s worse if they use social engineering to pose as a friend or coworker, requesting a “lost login” for a project.
The only safe strategy here is to employ password management software, much like you would for sharing them.
There are several critical reasons for this:
- Management software encrypts passwords, meaning it’s protected when viewed by different team members.
- Software always assures all users have the up-to-date login variant; if you need to respond quickly to password changes, everyone’s on the same page.
- Some management software can track password usage behavior. Tracking allows you to identify unusual login behavior, such as multiple incorrect login attempts on a device/and or browser.
- Passwords are kept in one place versus spread out among users where they can potentially be leaked/stolen.
Implementing a Password Strategy
Even with all the methods and recommendations you’ve read about, it won’t mean much if you don’t follow good password strategies. This is especially important in a business situation.
If your enterprise needs to tighten up on login security, we recommend deploying these points inside your organization:
- Password Security Tip 1
Make sure each user utilizes complex passwords via the methods we’ve suggested. One weak login is all it takes to compromise internal security. - Password Security Tip 2
Create a list of easy-to-follow guidelines visible to all staff members. Written password guidelines assure they’re “in the know” and have a procedure to follow. - Password Security Tip 3
Speaking of procedures, have a backup plan in case a password is lost. In most cases, this falls under a BDR (backup and disaster recovery) umbrella, but you’ll want a unique approach for logins too. For instance, if a password is lost, the backup plan could call for an email to be sent to all staff recommending they immediately change logins. - Password Security Tip 4
Have different logins for different platforms. Users might log in to their workstation but also need a password for a certain kind of software. Though it’s arduous, this creates additional layers of protection. - Password Security Tip 5
Enable two-factor authentication. Multi-Factor Authentication, also known as “MFA”, is a healthy modern solution to password concerns, as it means a device is required along with the login.
Once you establish these guidelines, you create a strong foundation for good password habits. Not only for an enterprise but on a personal level too.
Multi-Factor Authentication (MFA)
If you aren’t using MFA at your practice, it’s time to jump on the bandwagon. MFA will take your password game to the next level and make your practice much more secure. Most software programs have MFA built-in, and it just gives your practice an additional layer of protection.
With MFA, websites require an additional one-time authentication code sent to the user’s phone, email, or other devices. That way, even if a criminal gets their hands on your password, they will remain locked out of your account without the authentication code.
Conclusion
Cybersecurity is a growing concern, and there are many aspects of it to consider. Passwords are a crucial aspect of an integrated, layered approach to security, which is your best shot at keeping your organization protected. So, make your first defense strong.
Treat your password like you would your toothbrush: choose a good one, don’t share it with anyone, and change it occasionally. If you want to encourage strong passwords in your organization, one of the best ways is to implement a formal, written password policy. A password policy will provide guidelines and requirements for your employees to help them create strong passwords. It will also give them the tools to practice better habits with their passwords.
Dental IT. Remove the Burden. Embrace the Use.
Quality patient care – it's ultimately why you became a dental professional. But, some business operations can get in the way (such as pesky computer issues or lack of IT support). That’s where Pact-One Solutions can help! Our passion lies in supplying reliable, responsive dental IT support and security that practices can count on.
Whether you’re looking for dental IT services for your startup or searching for more responsive dental IT support – our team of dental IT specialists have you covered. With team members throughout the United States, we offer nationwide support to dental practices of all sizes. Our wide range of dental IT services ensure your data is secure, accessible, and protected.
Don't let technology challenges hinder your ability to deliver exceptional dental care. Contact us at info@pact-one.com or 866-722-8663 to join 350+ dental practices thriving with the support of a dedicated dental IT team.
