What makes a good password?
All users of information resources are responsible
for assisting in the protection of the systems they use. Many intruders
enter systems simply by guessing passwords and even the best passwords
can eventually be defeated mathematically, given enough time. The use
of strong passwords acts as a firm deterrent against password guessing
attacks, and buys additional time against other attacks.
| DO’S |
DONT’S |
- DO use a password with mixed-case letters. Use uppercase letters throughout the password.
|
-
DO NOT use a network login ID in any form (reversed, capitalized, or doubled as a password).
|
- DO
use a password that contains alphanumeric characters and include
punctuation, where supported by the operating system.
|
- DO
NOT use your first, middle or last name or anyone else’s in any form.
Do not use your initials or any nicknames you may have or anyone
else’s.
|
- DO
use a password with mixed-case letters. Do not just capitalize the
first letter, but add uppercase letters throughout the password.
|
- DO
NOT use a word contained in English or foreign dictionaries, spelling
lists, or other word lists and abbreviations.
|
- DO use at least six characters, eight characters for Windows NT.
|
- DO
NOT use other information easily obtained about you. This includes pet
names, license plate numbers, telephone numbers, identification
numbers, the brand of your automobile, the name of the street you live
on, and so on. Such passwords are very easily guessed by someone who
knows the user.
|
- DO use a seemingly random selection of letters and numbers.
|
- DO
NOT use a password of all numbers, or a password composed of alphabet
characters. Mix numbers and letters.
|
- DO
use a password that can be typed quickly, without having to look at the
keyboard. This makes it harder for someone to steal your password by
looking at your keyboard (also known as "shoulder surfing").
|
- DO NOT use dates e.g., September, SEPT1999 or any combination thereof.
|
- DO
change passwords regularly. The more critical an account to network
integrity (such as root on a Unix host or Administrator on Windows NT),
the more frequently the password should be changed. This change stops
someone who has already compromised an account from continued access.
|
- DO NOT use keyboard sequences, e.g., qwerty.
|
| |
- DO
NOT use a sample password, no matter how good, that you’ve gotten from
a book that discusses information and computer security.
|
| |
- DO NOT use any of the above things spelled backwards, or in caps, or otherwise disguised.
|
| |
- DO
NOT write a password on sticky notes, desk blotters, calendars, or
store it online where it can be accessed by others.
|
| |
- DO NOT use shared accounts. Accountability for group access is extremely difficult.
|
| |
- DO NOT reveal a password to anyone.
|
|
Suggestions For "Strong" Passwords
Common suggestions for constructing seemingly random passwords are:
1. Use the first letter of each word from a line in
a book, song, or poem. For example: "Who ya gonna call? Ghost Busters!"
would produce "Wygc?GB!”
2. Use the output from a random password
generator. Select a random string that can be pronounced and is easy to
remember. For example, the random string "adazac123" can be pronounced
a-da-zac, and you can remember it by thinking of it as "A-to-Z,1
through 3." Add uppercase letters to create your own emphasis, e.g.,
aDAzac.2
3. Use two short words connected by punctuation, e.g., T1me#0ff
4. Use numbers and letters to create an imaginary vanity license plate password, e.g., 1H8work!
A common theme of these suggestions is that the
password should be easy to remember. Avoid passwords that must be
written down to be remembered. If unrecallable, someone in your office
may find the password you have written down, and compromise your
network identity.
These guidelines and suggestions should enable you to
choose strong passwords that will help you improve the security of your
system.
Additional Notes:
The CERT/CC (Computer Emergency Response Team /
Coordination Center), a federally funded organization based at Carnegie
Mellon University, estimates that 80% of all network security problems
are caused by bad passwords; therefore, good passwords are the
simplest, and most important part of information security.
