In a world where it feels like we’re online more than we’re offline, and where virtually everything online now requires a password, it’s no wonder that many of us, when we can, use the same password for numerous sites. Frankly, it’s much less taxing to our overburdened memories to use the same password for anything and everything from our online banking accounts to music streaming and credit card accounts, to our social media accounts. Sure, we’re told to change our passwords often, and to make them “robust” and “secure,” but how many of us really do that? Akin to drinking eight glasses of water a day and eating five servings of vegetables – we know we should be changing our passwords more often but it’s such a hassle remembering them all, right?
If that sounds like you, then the recent news of an estimated 272.3 million LinkedIn usernames and passwords being stolen should be very distressing news indeed. Thefts like these – and there seems to be a new breach, and hundreds of thousands of user IDs and passwords stolen, every week – should send a strong shiver down your spine. You’ve heard it before, but if nothing else, this should provide a strong incentive to change those passwords frequently; and when you do change them, pay attention to the admonitions by site managers and the online community to make them “strong” and, if possible, “unique.”
Most of us know that, to be harder to “crack,” a password needs to contain more than just a few letters or street numbers, dog’s names, and kid’s birthday digits. Gone are the days of “Password123” as the office’s default password. Now it’s all about special characters and a mix of uppercase and lowercase letters, in addition to numbers and at least a few symbols such as #@^&*. But just how important is all of this? A stolen password can be as obtuse as you want, but if it’s stolen, it doesn’t matter how hard to guess it is now, does it? Which begs the question: do we really need to worry so much about our run of the mill passwords?
The short answer is a resounding YES. Tabling the stolen password argument for a moment and focusing simply on hackers “guessing” or using the various tools at their disposal to crack your password, then yes, a somewhat randomized, not instantly obvious password (one NOT featuring your dog or kid’s name, which is often easily obtainable from your social media accounts, for example) is absolutely going to be harder to crack than Password123 or Sparky456, for example. Some hackers will use programs that simply try more or less all of the combinations they can and, given enough time and tries, they’ll succeed, at least some of the time. And when they do, you’re sunk. So in this case a strong lock is better than a piece of string on your digital door.
Now, back to whether it’s really important to have a unique password for each of your accounts, the answer here too is an emphatic YES. In Russia’s underground network, experts estimate that there are millions of usernames and passwords for sale at any given time, as a result of earlier cybercrime activity, much of it beginning years ago. And once hackers find a lucrative opening somewhere, or a new data source, you better believe they’ll make the most of it. And if, say, your LinkedIn password and user ID combo is stolen, if that same combo opens, say, five of your other accounts, including a credit card or bank account – like a master key opening several locks in your digital building, well, you can start to see how much trouble you’re about to be in. Think about how devastating that could be, and you might re-think your “same password for multiple sites because I’m lazy” strategy. The best strategy is taking extra care of email passwords, since most other accounts are linked to Semail address and
when you change or heaven forbid forget your password, you’ll use that email account to reset and change that password.
The other password hygiene recommendation is how frequently to change your password… If the password is strong and your haven’t been notified of a breach in your account then it’s fine to do a six-month cycle. If your provider has been breached then change that password NOW.
One of the most insidious, pervasive and “productive” hackers in recent years is allegedly responsible for a significant amount of the information now available on the Russian underground. Because he’s stolen data from such a wide variety of sources, researchers have named him “The Collector.” Multiply his activity by tens of thousands of other hackers and you start to see the breadth of the problem we’re facing.
“We’re seeing a proverbial panic in the streets because millions of passwords (may) have been stolen. But that reaction is the opposite of how the cybersecurity industry is reacting – since that’s all we think about every day: hoping for the best, but definitely planning for the worst,” said John Peterson, Vice President, Enterprise Product Management & General Manager at the cybersecurity company Comodo. “There needs to be a sense of heightened security every day when it comes to cyberattacks and thinking passwords might be stolen. Consumers, small businesses and large enterprises all need to understand that criminals have well-established, working organizations with paid hackers, spammers kand phishing experts who think of new ways to steal and leverage passwords, bank records, social security numbers, company trade secrets and data, and credit card and financial data, every minute of every day. Only with end-to-end security that takes into account issues like endpoint, breach detection and secure web gateways can companies of all sizes look to beat cybercriminals at their own game.”
Every day we need to be on the lookout for potential threats, but even with all of the latest information — even if you follow all of the online cyber intelligence magazines and blogs on a regular basis, there is simply no way to stay ahead of all of the malware threats being generated daily, and in unprecedented numbers. This is why a Default Deny Platform – compared to a standard default allow platform – becomes incredibly important, and why automatically containing all unknown files is the only truly safe option out there. Remember, every piece of malware starts out as an unknown file or link. Only when you protect yourself not only from all known malware but ALSO from all unknown, potentially malicious, files and executables, can you truly stay safe while remaining entirely productive. Otherwise, it’s almost a guarantee that your system will be infected and infiltrated at some point. The only question is based on the severity of the attack, just how far your system and your data – and your customers’ data – will be compromised.
So, use ugly, hard to remember unique passwords, and change them early and often, and perhaps use one of the legitimate password apps or services on the market to help you keep track of them, back up your files regularly, and protect your business with a security solution like Comodo 360 built on a robust Default Deny Platform featuring lightweight automatic containment to stop malware in its tracks.
