tigrisnet

We use passwords everywhere these days, not just on our computers but the various electronic devices and the endless accounts we seem to accumulate. With increased security measures on many websites and accounts to try to protect our sensitive data, we are being asked increasingly to create complex passwords, but are we benefiting? Where did passwords come from? Passwords have been around in one form or another for centuries. Its thought that the Roman military used passwords to distinguish friend from foe and there are documented uses of cyphers throughout history.  However, the first use of passwords for computers happened in 1960at MIT. Fernando Corbato developed the password as a way to protect individual files from being accessed by other people on a compatible Time-Sharing System (CTSS) that several researchers had access to. Until the 90’s when the World Wide Web boom happened the need for computer passwords was not a significant issue. Suddenly there needed to be a way to protect the increasing volume of sensitive data that was being collected about people. When did passwords become complex? In 2003 the US National Institute of standards and Technology (NIST) released an official guidance that was written by an engineer named Bill Burr. This guidance is the basis on which password requirements are dictated. In his 8 page document Burr outlined the need for passwords to have mix of lower and uppercase, use of numbers and special characters and even that passwords should be of minimum length. He also advised that passwords should be changed regularly. Did it improve security? Well there is no doubt that longer more complex passwords are better choice than short easy to guess passwords. There are draw backs to using long passwords. Due to limitations of human memory the ability to recall a long string of letters and numbers can be difficult, which leads most people to either write them down, creating a security issue itself, or they often use the same password to access all their accounts. The problem is that if a hacker guesses the password then they have access to every account. Yet this is still a very common problem. Due to the large number of accounts a person holds they would struggle to create and remember a unique strong complex password for each they create an easy to remember password, which would be fine except that so many people think similarly and use the same password. Research has shown that globally the most popular password is ‘123456’. So the concept was promising but the problem was that most people didn’t understand the reasoning and so just didn’t follow guidance when creating the password and instead opted for convenience. What is the advice now? In 2017 NIST overhauled their advice document completely and now actually recommend the use of passphrases that are much harder to guess than a string of non-sense characters that can be more easily decoded by a computer. So using a string of unrelated words will give you better security on your accounts. Although the current trend is moving to using 2-step authentication by way of password and biometric which will see security improved while maintaining the convenience. NIST also no longer recommend||| that passwords should be changed regularly and instead advise that only done so should there be a need e.g. a breach occurs.

Many people are unaware of how vulnerable they are to data breaches. Anyone is at risk of experiencing a data breach from a single individual to corporations and governments. It is the person or organisation’s responsibility to protect their data. Since the introduction of GDPR, it is a legal liability for companies that carry fines up to €20 million or 4% of turnover. What is a Data Breach, and how do they occur? A data breach can be defined as a security violation in which sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an individual unauthorised to do so. The compromisation of data can have adverse effects for both the party that has had their data breached but also the people or organisations who have had their data stolen/exposed. Breaches will happen due to weakness in either the technology or user behaviour. Data breaches are not always from the outside of an organisation; it can come from inside. An accidental data breach can occur when an unauthorised person views sensitive data. Even if the data is not shared, it would still be considered a breach of data because a person saw it with no authority to do so, and this could have many repercussions. A malicious insider data breach is when sensitive data is purposely accessed by an unauthorised individual and shared/exposed with intent to cause harm to the company/organisation. Another form of a data breach is when an unencrypted and unlocked device containing sensitive data is lost/stolen. Most data breaches will come externally to the organisation and commonly by a cyberattack, which can happen by way of different methods; Phishing Brute force attack Malware How to prevent data breaches? Companies and organisations need to take the necessary steps to protect the data they hold. Protecting data of customers/clients is crucial for building trust between the company/ organisation and the customer/client. There are several practices to consider when looking to protect a company’s data from breach; Patching & updating software to help ensure any known vulnerabilities are repaired and secured. High-grade encryption on all devices to protect the sensitive data it contains should it be stolen or lost. Ensure all devices connected to the network/servers have adequate antivirus protection and business-grade VPN, including any “bring your own devices” employees have been allowed to use in any way to access company data. Use strong credentials and multi-factor authentication to protect data from being accessed by password guessing. Educating employees on the importance of data protection and potential vulnerabilities. Increasing awareness will help reduce the possibility of mistakes that can lead to data breaches. Also giving them the tools to recognise possible malicious behaviour in others. Using intruder detection on any systems that are accessible to the internet such a servers and email systems, to protect the data contained within them. Backing up to the cloud will eliminate the risk of sensitive data being stolen from backup drives and data backup tapes. Systems should be very regularly scanned and checked for vulnerabilities. Security can only be as strong as the weakest point in the system. So a regular risk assessment will minimise the risks of data breaches. Implement automated safeguards such as password checking and assess firewall configuration. Automated safeguards will aim to reduce human error, which accounts for most cases of data breaches. By following these practices, organisations and individuals can significantly reduce the chance of a data breach and in turn protect your company and personal data.