SECURE IT - August 2023

A monthly Information Security publication for the WPI community.

This month let's focus on PASSWORD HYGIENE. It's a set of best practices that reduces the likelihood of your account being compromised. 

In this issue:

• Password Managers
• Password Cracking Techniques
  
• Passwords by the Numbers
• How to Make a Strong Password
• Expired Password Phishing Scam at WPI
• Learning with Laughter
• Breach Notifications
• Where to Find Information Security?
• Featured Videos
• Passwords in the News
• Diversity in Cybersecurity
• Additional Password Resources on the Hub
  
• Coming Next Month...

Password Managers

While technology promises to make our lives easier, and it generally does, every new website and application we sign up for is another password we must remember. For most, it becomes impossible to remember all of them. Think about yourself – do you reuse your passwords on multiple accounts? This is considered risky, so utilizing a password manager can reduce your risk.

What is a Password Manager?

A password manager is a software application designed to store and manage online credentials and generate strong passwords. The passwords are usually stored in an encrypted database and locked behind a master password. Once you log into a password manager using a "master" password, you then create an entry for a specific application and utilize the password manager for logging into that application.

Steps to Set Up a Password Manager:

1. Download a password manager program.

2. Create a master password for your password vault.

3. Start logging into your accounts.

4. Begin to change your passwords.

Pros and Cons of Password Managers

While password managers have many benefits, they are not foolproof. Weighing these pros and cons against your needs and habits can help you to decide what is best for you. (There is not currently a specific password manager that WPI Information Technology recommends or supports as university software.)

PROS:

1. No need to memorize all your passwords.
2. Help to protect your identity.
   
3. A highly secure password is generated for you.
   
4. They enable easy access to accounts across multiple devices.
   
5. Many password managers work across different systems, for quick access to your passwords regardless of which system you’re on.
   
6. Saves time.

CONS:

1. Password managers have been hacked, but overall, their track record when it comes to securing data is very good.
2. Password managers can be a single point of failure, for instance, if the master password is forgotten or lost.
   
3. All of your sensitive data is stored in one place.
   

Password Cracking Techniques

Because hackers have varied methods to make many password attempts in just a few seconds, creating strong and varied passwords or passphrases is more important than ever.  People who don’t use password managers often use the same passwords for all their accounts, leaving them vulnerable to credential compromise.

Hackers often use algorithms to repeatedly guess the password, including making common number and symbol replacements for letters. So you can't trick them by changing your password from mypassword to mypa55word!  

Brute force attacks try combinations of characters of a predetermined length.

Dictionary searches run through known words; password dictionaries even exist for a variety of topics, including politics, movies, and music groups.

Phishing attacks lure a user into clicking on an email attachment or link where the user enters their password or malware is installed. The malware might track keystrokes or take screenshots to nab the password. 

Rainbow attacks use different words from the original password in order to generate other possible passwords. Malicious actors keep a list of leaked and previously cracked passwords, which will make the overall password cracking method more effective.

Guessing! An attacker may be able to guess a password without the use of tools. With enough information about the victim or a victim who uses a common password, they may be able to come up with the correct characters.

These definitions came from Techtarget.com, and the article below offers more details.

Passwords By the Numbers

Microsoft did a study of over 280,000 attacks and analyzed the compromised password data. This is what they found:

Time it Takes a Hacker to Brute Force Your Password in 2022

Color Code:

• Purple - Cracked instantly; use 4-11 characters and do not use a variety of characters.
• Red - Cracked in a few seconds to 5 months; use 7 - 18 characters and some variety of characters.
• Orange - Cracked in 3 years to 69,000 years; use 11 - 17 characters and a wider variety of characters.
  
• Yellow - Takes 202,000 years to 9 billion years to crack; use 13 - 18 characters with a wide variety.
  
• Green - Takes 92 billion years to 438 trillion years to crack! They use 16 - 18 characters with a wide variety.
  

How to Make a Strong Password

These best practices help protect your accounts:

• Don’t reuse passwords.
• Create complex passwords with a variety of character types.
• Use a passphrase, a series of words that are easy to remember but hard to guess, such as a favorite quote.
• Enable multi-factor authentication (MFA).
  

Example of Passwords with Increasing Complexity

Expired Password Phishing Scam at WPI

WPI passwords do not expire. However, bad actors have recently tried luring WPI account holders in by emailing a phony expired password notification. If you receive a message like the one below, then it's a scam. One way to check is to hover the mouse over the button or link and look in the lower left corner of the screen to see the real address for where it will bring you.

Check out the Phish Bowl for Other Recent Attempts:

Learning with Laughter