The predominant type of password attack is a brute force attacks which can come in a variety of forms including simple brute force attacks, where a hacker tries to guess the password themselves without any software assistance or dictionary attacks, they might use a dictionary of common words used by the business or individual to guess a password. As mentioned, these attacks can have devastating effects on a business, stealing customer information, spreading malware, redirecting traffic to spam websites or in extreme cases hijacking the website completely. But there are ways to prevent these scenarios from occurring. Read on below to find out more:
Effective Security Measures
1. Use A Strong Password
One of the most well known ways to ensure high levels of password security, but surprisingly, many still use easy to guess passwords such as their pets name or easy combinations such as “password1234”. A strong password should look to be 14 characters, be a random mix of letters, characters & numbers and shouldn’t contain repeated characters. Utilising the same passwords across multiple accounts should be avoided to limit further exposure if one of your accounts is hacked.
2. Invest In Effective Data Handling & A Password Manager
With any sensitive data surrounding a business it is important that effective data handling practices are in place. Not only in relation to the distribution of information, but also in terms of data storage. Make sure all employees are across all of these practices, to avoid any lapses in your websites security. A password manager can also help alleviate this issue as they provide a safe and encrypted method of storing hundreds of passwords, without users having to individually remember each one. Some examples of effective password managers include BitWarden, 1Password and LastPass. Many password managers also offer a host of other benefits such as helping to generate new passwords for new accounts a user creates, alerting a user if their personal confidential information is utilised, auto-filling online forms and, most importantly, encrypting all of the saved passwords.
3. Utilise Two Factor Authentication (2FA)
Two-Factor Authentication or Multi Factor Authentication, as the name suggests, involves two different steps for individuals verifying their identity when logging into an account. One of the most common examples of this is when an individual puts in their log in details, but then has to verify their identity through a code they receive via text. There are also a host of other options, such as answering a security question, inputting a secondary key phrase or passcode or even utilising an authentication app. In these instances, potential hackers are severely hampered as they no longer require one piece of information to access the account. While there are a few options available, some methods are superior to others. For instance, a security question or key phrase can be easily found out such as “a mother’s maiden name” or “your pet’s name” and text messages can get hacked or redirected. The most effective method of 2FA is through an authentication application which can work without a carrier network and deletes all codes sent usually within 30 to 60 seconds. 2FAs are also offered as options on a number of different sites including Facebook, Paypal, Google, LinkedIn and Dropbox.
4. Limit Login Attempts
While not being a specifically preventative measure for password attacks, the limiting of login attempts is a method to slow the progression of a password attack. This can be done one of two ways. Firstly, once a user tries to login with the incorrect details they will be asked to wait for a period of time before they can try to login in again. This time period will increase with each incorrect login attempt, similarly to many smartphones today. The second method involves setting a number of login attempts before the user is locked out of their account and needs to provide another method of verification. Both of these methods can be highly effective and it is also worth attaching notifications to these measures when a new login attempt or multiple login attempts have been made. In fact, many applications such as Facebook & Gmail offer these when a user logs into their account on a new device and is sent an email notification to confirm their ID.
For any business operating online, effective password security measures are a must to ensure minimal exposure, protecting your website and sensitive information. Whether you are looking to upgrade your current password security procedures or creating a new website and want to find out more about password security, contact the team at Redline Digital today.
