No matter how many clients’ sites I visit it’s always interesting enough when working on a particular problem concerning their PCs, servers or even firewalls. It just amazes me when I’m provided with a user name and password to log onto the device and the password is very weak! Now what is a weak password? One example of a weak password is the word – Kitty. A password such as this wouldn’t take a dictionary attack but a mere few seconds or minutes if that long to crack. Good passwords always have upper and lower case letters, symbols, and number combinations. There are approximately around 420,000 – 500,000 words in the English language. A strong password can make the difference between allowing an intruder unauthorized access to your PC. Examples of a good password look similar to this “Jv*Ed20$91^” or even “Dads&&787!!**”. A strong password combination can take quite a bit of time to hack. I doubt if a hacker would spend weeks or even months running a brute force dictionary attack to break into your PC. They simply would turn their attention to other millions of unprotected PCs out there with far weaker security in place.
Quite a few of these PCs have no presence of anti-malware (virus, Trojan horse, adware) protection and strong password policy in place. Not to mention some type of hardware based appliance firewall installed to prevent unauthorized intrusion. Despite the big hype, moving to the clouds doesn’t make data any safer! Users and corporations ignoring strong password policy and frequently changing passwords will find devices and sensitive data hacked and compromised. Intruders could easily gain access to an unprotected computer with no form of firewall or anti-malware protection compromising user names and passwords.
Another danger I see so often is users saving passwords to bank accounts or corporate intranets and even e-mail in their browsers. Infected computers could possibly allow attackers to gain access in the background to the PC while the user is browsing the internet. This type of silent attack can cause you damage as the hacker may change the password to your bank account or any other online accounts. This type of activity could even allow the attacker to log in from a remote geographic location to steal sensitive personal or corporate information. Whether it’s a home user or corporate user there has to be in place stiffer password policies with proper password rotation and other preventive measures and then sticking to them. It’s always best for corporations to follow the rule of access control, “Authentication, Authorization, and Accountability” (AAA).
