Your IT system had better know before allowing that person access.
While medium and larger businesses have the need and the assets to support sophisticated security measures, such as smart cards and biometric identification, most small businesses rely on passwords for system security.
Many password systems are flexible enough to allow different classes of employees more or less access to the system, depending on their password. For example, sales staff would have access to customer records and inventory, but not accounting or HR files. Similarly, accounting and HR departments would have access only to those files that they need to conduct their business. Only top management would have access to the entire system.
What makes a secure password?
• It is at least eight characters long.
• It contains upper and lower case letters, numbers and special characters, e.g. $, %, #.
• It contains at least five characters different from the password it is replacing.
• It should be able to be typed quickly. This discourages someone looking over your shoulder as you type, aka “shoulder surfing.”
• It should be changed at intervals not longer than six months. This makes your password a moving target and thus harder to crack
Choosing good passwords can be thought of as more art than science. Given that any password can be cracked if given enough time, there are ways to make the process long enough to frustrate all but the most determined hackers.
Razor Security Technologies offers a clever way to create a complex password that requires no memorization. Start by choosing an area of the keyboard to use for your password. Next, decide on a pattern for the password. For example, take the upper-left quadrant of the keyboard and create three lines using 2ws3ed4r or, better yet, combine that sequence with shift characters to get 2ws#ED4r. With this method, you don’t have to memorize any passwords; you simply have to remember where the pattern starts on the keyboard.
To complete the job, a password must be protected locally. There are several obvious practices to avoid.
Don’t write your password down. Design a password with a mnemonic to make it easier to remember. If you must write it down, treat it as you would a credit card or your Social Security number or your bank PIN. Never put it on a sticky note or under a phone or desk pad or keyboard or other obvious places to look. And don’t use the “Remember password?” feature some Web sites offer.
A business colleague had about two dozen passwords for the various Web sites he visited. He knew to use different passwords for each site, but rather than commit them to memory, he listed them in a Word document in his Documents folder. The file name was Passwords.doc. Not a good idea.
If you absolutely, positively, must store your passwords on your computer, put them on an Excel spreadsheet or a single-frame Power Point presentation so their presence will be less obvious. Name the file anything but “Passwords” and make it a hidden file. This will eliminate casual snoopers.
Never share your password with anyone. If there is an overriding operational necessity that requires that someone else has temporary access to your files, give them your password, but change it immediately after the need passes to minimize your exposure.
Last, and perhaps most important, if you suspect that your password has been cracked, stolen or otherwise compromised, change it immediately.
Stan Elias writes on business and technology issues and operates Tensor Communications, a West Barnstable-based marketing and communications agency specializing in high-tech companies. He can be reached at 323-401-1290 or